apache/hadoop · error · InvalidAclOperationException

Access mask is required when a named access acl is present.

Error message

Access mask is required when a named access acl is present.

What it means

Error "Access mask is required when a named access acl is present." thrown in apache/hadoop.

Source

Thrown at hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/services/AbfsAclHelper.java:114

      throws AzureBlobFileSystemException {
    boolean accessAclTouched = false;
    boolean defaultAclTouched = false;

    final Set<String> removeIndicationSet = new HashSet<>();

    for (String entryKey : toRemoveEntries.keySet()) {
      final boolean isDefaultAcl = isDefaultAce(entryKey);
      if (removeNamedAceAndUpdateSet(entryKey, isDefaultAcl, removeIndicationSet, aclEntries)) {
        if (isDefaultAcl) {
          defaultAclTouched = true;
        } else {
          accessAclTouched = true;
        }
      }
    }

    if (removeIndicationSet.contains(AbfsHttpConstants.ACCESS_MASK) && containsNamedAce(aclEntries, false)) {
      throw new InvalidAclOperationException("Access mask is required when a named access acl is present.");
    }

    if (accessAclTouched) {
      if (removeIndicationSet.contains(AbfsHttpConstants.ACCESS_MASK)) {
        aclEntries.remove(AbfsHttpConstants.ACCESS_MASK);
      }
      recalculateMask(aclEntries, false);
    }

    if (removeIndicationSet.contains(AbfsHttpConstants.DEFAULT_MASK) && containsNamedAce(aclEntries, true)) {
      throw new InvalidAclOperationException("Default mask is required when a named default acl is present.");
    }

    if (defaultAclTouched) {
      if (removeIndicationSet.contains(AbfsHttpConstants.DEFAULT_MASK)) {
        aclEntries.remove(AbfsHttpConstants.DEFAULT_MASK);
      }
      if (removeIndicationSet.contains(AbfsHttpConstants.DEFAULT_USER)) {

View on GitHub (pinned to 2add963021)

Solutions

1. Include the access mask (permissions) entry in the ACL when any named user or group access entry is present.
2. Add 'mask::rwx' with the appropriate permissions to the ACL spec.

When it happens

Trigger: An ACL with named access entries is set without the required access mask entry.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/1e4ab658c92de003. Report an issue: GitHub.