A good question, and one that is not easily answered. Accessing files and directories from within an EJB container is possible, although one of the reason why it isn't "allowed" is because you are using the EJB container for the infrastructure rather than the underlying operating system (if you see what I mean). For this reason, trying to access specific files and directories isn't portable.
However, most (all?) application servers don't actually restrict access to the java.io package.
In terms of logging, you'll notice that many people use
log4j, which of course under the hood uses the java.io packages. From what I've seen, most people just use log4j (or some other framework) and ignore such restrictions.
Out of interest, has anybody actually seen an app server in which log4j doesn't work?
Simon