apache/hadoop · error · UnsupportedOperationException

{} doesn't support modifyAclEntries

Error message

{} doesn't support modifyAclEntries

What it means

FileSystem.modifyAclEntries(Path, List<AclEntry>) is optional; the base class throws UnsupportedOperationException with getClass().getSimpleName() + " doesn't support modifyAclEntries". ACL APIs are implemented by HDFS-family clients (DistributedFileSystem, WebHdfsFileSystem, HttpFSFileSystem), azurebfs (ABFS maps ACLs to the account's POSIX ACLs) and view/chroot/filter pass-throughs. RawLocalFileSystem and S3A/GCS do not implement them, so they inherit the throwing default.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java:3150

    throw new UnsupportedOperationException(getClass().getSimpleName()
        + " doesn't support deleteSnapshot");
  }

  /**
   * Modifies ACL entries of files and directories.  This method can add new ACL
   * entries or modify the permissions on existing ACL entries.  All existing
   * ACL entries that are not specified in this call are retained without
   * changes.  (Modifications are merged into the current ACL.)
   *
   * @param path Path to modify
   * @param aclSpec List&lt;AclEntry&gt; describing modifications
   * @throws IOException if an ACL could not be modified
   * @throws UnsupportedOperationException if the operation is unsupported
   *         (default outcome).
   */
  public void modifyAclEntries(Path path, List<AclEntry> aclSpec)
      throws IOException {
    throw new UnsupportedOperationException(getClass().getSimpleName()
        + " doesn't support modifyAclEntries");
  }

  /**
   * Removes ACL entries from files and directories.  Other ACL entries are
   * retained.
   *
   * @param path Path to modify
   * @param aclSpec List describing entries to remove
   * @throws IOException if an ACL could not be modified
   * @throws UnsupportedOperationException if the operation is unsupported
   *         (default outcome).
   */
  public void removeAclEntries(Path path, List<AclEntry> aclSpec)
      throws IOException {
    throw new UnsupportedOperationException(getClass().getSimpleName()
        + " doesn't support removeAclEntries");
  }

View on GitHub (pinned to 2add963021)

Solutions

  1. Probe capability first: fs.hasPathCapability(path, CommonPathCapabilities.FS_ACLS)
  2. On stores without ACLs, fall back to POSIX bits via setPermission/setOwner — those are universally implemented
  3. Catch UnsupportedOperationException and record that the store is permission-bits-only; do not retry
  4. With distcp, drop the acl/xattr preservation flags when the target cannot honor them

Example fix

// before
fs.modifyAclEntries(path, Collections.singletonList(
    AclEntry.parseAclEntry("user:analyst:rwx", true)));
// UnsupportedOperationException on LocalFileSystem/S3A

// after
if (fs.hasPathCapability(path, CommonPathCapabilities.FS_ACLS)) {
  fs.modifyAclEntries(path, aclSpec);
} else {
  fs.setPermission(path, FsPermission.valueOf("rwxr-x---")); // bits fallback
}
Defensive patterns

Strategy: try-catch

Validate before calling

import org.apache.hadoop.fs.CommonPathCapabilities;

if (fs.hasPathCapability(path, CommonPathCapabilities.FS_ACLS)) {
  fs.modifyAclEntries(path, aclSpec);
} else {
  fs.setPermission(path, fallbackPermission);
}

Type guard

static boolean supportsAcls(FileSystem fs) {
  return fs instanceof DistributedFileSystem
      || fs instanceof WebHdfsFileSystem;
}

Try / catch

try {
  fs.modifyAclEntries(path, aclSpec);
} catch (UnsupportedOperationException e) {
  // class in e.getMessage() is bits-only: degrade to setPermission
}

Prevention

When it happens

Trigger: Calling fs.modifyAclEntries(path, aclSpec) on file://, s3a://, gs://, har://, or a custom FileSystem without the override; security-provisioning code that grants per-user ACLs unconditionally at dataset creation.

Common situations: ACL provisioning tooling written for HDFS and run in local unit tests; data-lake permission scripts reused after migrating a dataset from HDFS to S3; distcp -p (preserve acl) targeting a non-supporting filesystem.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/14bcd3b6c3a3fe87. Report an issue: GitHub.