apache/hadoop · error · AclsNotSupportedException

ACLs not supported for file system: {uri}

Error message

ACLs not supported for file system: {uri}

What it means

Pre-submission fail-fast check: when -p includes ACLs (-pa), DistCpUtils.checkFileSystemAclSupport() calls fs.getAclStatus(new Path("/")); any exception means ACLs cannot be preserved, so CopyListing.AclsNotSupportedException is thrown (the DistCp CLI exits with ACLS_NOT_SUPPORTED = -3) instead of failing mid-copy.

Source

Thrown at hadoop-tools/hadoop-distcp/src/main/java/org/apache/hadoop/tools/util/DistCpUtils.java:497

    sorter.sort(sourceListing, output);
  }

  /**
   * Determines if a file system supports ACLs by running a canary getAclStatus
   * request on the file system root.  This method is used before distcp job
   * submission to fail fast if the user requested preserving ACLs, but the file
   * system cannot support ACLs.
   *
   * @param fs FileSystem to check
   * @throws AclsNotSupportedException if fs does not support ACLs
   */
  public static void checkFileSystemAclSupport(FileSystem fs)
      throws AclsNotSupportedException {
    try {
      fs.getAclStatus(new Path(Path.SEPARATOR));
    } catch (Exception e) {
      throw new AclsNotSupportedException("ACLs not supported for file system: "
        + fs.getUri());
    }
  }
  
  /**
   * Determines if a file system supports XAttrs by running a getXAttrs request
   * on the file system root. This method is used before distcp job submission
   * to fail fast if the user requested preserving XAttrs, but the file system
   * cannot support XAttrs.
   * 
   * @param fs FileSystem to check
   * @throws XAttrsNotSupportedException if fs does not support XAttrs
   */
  public static void checkFileSystemXAttrSupport(FileSystem fs)
      throws XAttrsNotSupportedException {
    try {
      fs.getXAttrs(new Path(Path.SEPARATOR));
    } catch (Exception e) {

View on GitHub (pinned to 2add963021)

Solutions

1. Drop 'a' from the -p attribute list when either endpoint lacks ACL support
2. For HDFS targets, enable ACLs: set dfs.namenode.acls.enabled=true (requires restart)
3. Probe support before submitting: hdfs dfsgetfacl / or fs.getAclStatus(new Path("/")) in a try/catch
4. If ACLs are mandatory, keep the destination on an ACL-capable filesystem

Example fix

# before: object-store target has no ACLs -> AclsNotSupportedException
hadoop distcp -p a hdfs://nn/src s3a://bucket/dst

# after: preserve only attributes the target supports
hadoop distcp -p hdfs://nn/src s3a://bucket/dst

static boolean supportsAcls(FileSystem fs) {
  try {
    fs.getAclStatus(new Path(Path.SEPARATOR));
    return true;
  } catch (Exception e) {
    return false;
  }
}
// drop FileAttribute.ACL from -p when supportsAcls(source/target) is false

try {
  new DistCp(options, conf).execute();
} catch (CopyListing.AclsNotSupportedException e) {
  // retry with 'a' removed from the preserve set (CLI exits -3 instead)
}

When it happens

Trigger: Copying with -pa to or from a filesystem lacking ACL support (S3A, ABFS, local FS, viewfs, older HDFS); HDFS with dfs.namenode.acls.enabled=false; getAclStatus failing due to permission problems on the root path.

Common situations: HDFS-to-object-store backup scripts that reuse -pa from HDFS-to-HDFS jobs; freshly installed clusters with ACLs disabled; targets on HDFS versions predating ACLs.

Related errors

• XAttrs not supported for file system: {uri}
• key + ": No such file or directory."
• {} doesn't support modifyAclEntries
• {} doesn't support removeAclEntries
• {} doesn't support removeDefaultAcl

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/3dccb847f0927797. Report an issue: GitHub.