apache/hadoop · error · UnsupportedOperationException

{} doesn't support setAcl

Error message

{} doesn't support setAcl

What it means

FileSystem.setAcl(Path, List<AclEntry>) is optional; the base class throws UnsupportedOperationException with getClass().getSimpleName() + " doesn't support setAcl". It fully replaces a file's ACL (must include user/group/other entries). Implemented by DistributedFileSystem, WebHdfsFileSystem, HttpFSFileSystem, ABFS and pass-throughs; not by RawLocalFileSystem or S3A/GCS.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java:3212

  public void removeAcl(Path path)
      throws IOException {
    throw new UnsupportedOperationException(getClass().getSimpleName()
        + " doesn't support removeAcl");
  }

  /**
   * Fully replaces ACL of files and directories, discarding all existing
   * entries.
   *
   * @param path Path to modify
   * @param aclSpec List describing modifications, which must include entries
   *   for user, group, and others for compatibility with permission bits.
   * @throws IOException if an ACL could not be modified
   * @throws UnsupportedOperationException if the operation is unsupported
   *         (default outcome).
   */
  public void setAcl(Path path, List<AclEntry> aclSpec) throws IOException {
    throw new UnsupportedOperationException(getClass().getSimpleName()
        + " doesn't support setAcl");
  }

  /**
   * Gets the ACL of a file or directory.
   *
   * @param path Path to get
   * @return AclStatus describing the ACL of the file or directory
   * @throws IOException if an ACL could not be read
   * @throws UnsupportedOperationException if the operation is unsupported
   *         (default outcome).
   */
  public AclStatus getAclStatus(Path path) throws IOException {
    throw new UnsupportedOperationException(getClass().getSimpleName()
        + " doesn't support getAclStatus");
  }

  /**

View on GitHub (pinned to 2add963021)

Solutions

  1. Probe fs.hasPathCapability(path, CommonPathCapabilities.FS_ACLS) before applying the template
  2. Fall back to setPermission/setOwner for the bits-only portion of the template
  3. distcp: omit ACL preservation (-p without acl) for non-HDFS destinations
  4. Catch UnsupportedOperationException and record the dataset as ACL-less in your permission catalog

Example fix

// before
fs.setAcl(path, aclTemplate); // throws on LocalFileSystem/S3A

// after
if (fs.hasPathCapability(path, CommonPathCapabilities.FS_ACLS)) {
  fs.setAcl(path, aclTemplate);
} else {
  fs.setOwner(path, templateOwner, templateGroup);
  fs.setPermission(path, templatePermission);
}
Defensive patterns

Strategy: try-catch

Validate before calling

if (fs.hasPathCapability(path, CommonPathCapabilities.FS_ACLS)) {
  fs.setAcl(path, aclTemplate);
} else {
  fs.setOwner(path, tplOwner, tplGroup);
  fs.setPermission(path, tplPermission);
}

Type guard

static boolean supportsSetAcl(FileSystem fs) {
  return fs instanceof DistributedFileSystem
      || fs instanceof WebHdfsFileSystem;
}

Try / catch

try {
  fs.setAcl(path, aclTemplate);
} catch (UnsupportedOperationException e) {
  // degrade to owner/group + permission bits
}

Prevention

When it happens

Trigger: Calling fs.setAcl(path, fullAclSpec) on file://, s3a://, gs://, har:// or a custom FileSystem without the override; 'apply this ACL template' provisioning steps in dataset-creation pipelines.

Common situations: Data-lake provisioning that stamps a standard ACL template on new datasets and is also run against staging/test buckets or local directories; distcp -p preserving ACLs onto a non-ACL target.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/05a407785592b233. Report an issue: GitHub.