apache/hadoop · error · AccessControlException

"Access denied for user " + pc.getUser() + ". Superuser or o

Error message

"Access denied for user " + pc.getUser() + ". Superuser or owner of parent folder privilege is required"

What it means

Quota changes are superuser-only by default; when dfs.permissions.allow.owner.set.quota=true, non-superusers are allowed but must own the parent directory of the target (checkOwner on iip.getParentINodesInPath()). FSDirAttrOp.setQuota catches the failed owner check and rethrows this clearer AccessControlException naming the required privilege.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirAttrOp.java:252

  /**
   * Set the namespace, storagespace and typespace quota for a directory.
   *
   * Note: This does not support ".inodes" relative path.
   */
  static void setQuota(FSDirectory fsd, FSPermissionChecker pc, String src,
      long nsQuota, long ssQuota, StorageType type, boolean allowOwner)
      throws IOException {

    fsd.writeLock();
    try {
      INodesInPath iip = fsd.resolvePath(pc, src, DirOp.WRITE);
      // Here, the assumption is that the caller of this method has
      // already checked for super user privilege
      if (fsd.isPermissionEnabled() && !pc.isSuperUser() && allowOwner) {
        try {
          fsd.checkOwner(pc, iip.getParentINodesInPath());
        } catch(AccessControlException ace) {
          throw new AccessControlException(
              "Access denied for user " + pc.getUser() +
              ". Superuser or owner of parent folder privilege is required");
        }
      }
      INodeDirectory changed =
          unprotectedSetQuota(fsd, iip, nsQuota, ssQuota, type);
      if (changed != null) {
        final QuotaCounts q = changed.getQuotaCounts();
        if (type == null) {
          fsd.getEditLog().logSetQuota(src, q.getNameSpace(), q.getStorageSpace());
        } else {
          fsd.getEditLog().logSetQuotaByStorageType(
              src, q.getTypeSpaces().get(type), type);
        }
      }
    } finally {
      fsd.writeUnlock();
    }

View on GitHub (pinned to 2add963021)

Solutions

Run the quota change as the HDFS superuser (hdfs user).
If owner-based quota self-service is intended, have the superuser chown the parent directory to the responsible user once, and keep dfs.permissions.allow.owner.set.quota=true.
For service accounts, use proxy-user (doAs) delegation instead of granting superuser credentials.

Defensive patterns

Strategy: validation

Validate before calling

UserGroupInformation ugi = UserGroupInformation.getCurrentUser();
if (!ugi.isSuperUser()) { // heuristic: check against your superuser/supergroup
  FileStatus parent = fs.getFileStatus(path.getParent());
  if (!ugi.getShortUserName().equals(parent.getOwner())) {
    throw new AccessControlException("Quota change on " + path
        + " requires superuser or ownership of parent " + parent.getPath());
  }
}
new HdfsAdmin(path.toUri(), fs.getConf()).setQuota(path, quota);

Try / catch

try {
  admin.setQuota(path, quota);
} catch (AccessControlException e) {
  if (e.getMessage().contains("owner of parent folder")) {
    // rerun as hdfs, or have admin chown the parent to this user first
  }
}

Prevention

When enabling dfs.permissions.allow.owner.set.quota, also chown the parent dirs to the responsible users.
Remember the rule is ownership of the PARENT directory, not the target.

When it happens

Trigger: HdfsAdmin.setQuota / 'hdfs dfsadmin -setQuota' or '-setSpaceQuota' by a user who is neither superuser nor owner of the target directory's parent - note the check is on the PARENT's owner, so owning the target dir itself is not enough.

Common situations: Self-service quota administration enabled (allow.owner.set.quota=true) without chowning parent dirs to the responsible users; department admins on shared trees like /shared/<team> where /shared is owned by hdfs.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/00b82e47301d718c. Report an issue: GitHub.