It would be nice if we auto-detected the visibility based on the file system permissions. 

If you look in ClientDistributedCacheManager.isPublic in the mapreduce project for Hadoop.  There is some code I wrote there a while ago that will do this same thing.  You should be able to copy it.

http://svn.apache.org/viewvc/hadoop/common/trunk/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/filecache/ClientDistributedCacheManager.java?revision=1431166&view=markup

line 235