apache/hadoop · error · NoPathPermissionsException

Empty ACL list

Error message

Empty ACL list

What it means

CuratorService.zkMkPath refuses to create a ZooKeeper node without an ACL: if the acls argument is null or empty it throws NoPathPermissionsException(path, 'Empty ACL list') before contacting ZK. In a secure registry every created node must carry ACLs, so an empty list is treated as a permissions misconfiguration rather than defaulting to open access.

Source

Thrown at hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/CuratorService.java:573

  /**
   * Create a directory. It is not an error if it already exists.
   *
   * @param path          path to create
   * @param mode          mode for path
   * @param createParents flag to trigger parent creation
   * @param acls          ACL for path
   * @throws IOException any problem
   */
  public boolean zkMkPath(String path,
      CreateMode mode,
      boolean createParents,
      List<ACL> acls)
      throws IOException {
    checkServiceLive();
    path = createFullPath(path);
    if (acls == null || acls.isEmpty()) {
      throw new NoPathPermissionsException(path, "Empty ACL list");
    }

    try {
      RegistrySecurity.AclListInfo aclInfo =
          new RegistrySecurity.AclListInfo(acls);
      if (LOG.isDebugEnabled()) {
        LOG.debug("Creating path {} with mode {} and ACL {}",
            path, mode, aclInfo);
      }
      CreateBuilder createBuilder = curator.create();
      createBuilder.withMode(mode).withACL(acls);
      if (createParents) {
        createBuilder.creatingParentsIfNeeded();
      }
      createBuilder.forPath(path);

    } catch (KeeperException.NodeExistsException e) {
      if (LOG.isDebugEnabled()) {

View on GitHub (pinned to 2add963021)

Solutions

1. Pass a non-empty ACL list, e.g. built with RegistrySecurity.buildACLs/system ACLs, or ZooDefs.Ids.OPEN_ACL_UNSAFE in tests.
2. Fix the ACL configuration so parsing actually yields entries, and assert the parsed list is non-empty before creating nodes.
3. Validate acls != null && !acls.isEmpty() at the call site to fail with a clearer message.

Example fix

// before
curatorService.zkMkPath("/registry/services", CreateMode.PERSISTENT, true, Collections.emptyList()); // -> NoPathPermissionsException("Empty ACL list")

// after: every created node needs at least one ACL
List<ACL> acls = registrySecurity.buildACLs("sasl:me@", kerberosRealm, ZooDefs.Perms.ALL);
curatorService.zkMkPath("/registry/services", CreateMode.PERSISTENT, true, acls);

Preconditions.checkArgument(acls != null && !acls.isEmpty(),
    "Cannot create registry node %s without ACLs", path);
curatorService.zkMkPath(path, mode, createParents, acls);

try {
  curatorService.zkMkPath(path, mode, createParents, acls);
} catch (NoPathPermissionsException e) {
  // ACL list was null/empty: fix ACL config or pass default ACLs, then retry
}

When it happens

Trigger: zkMkPath(path, mode, createParents, acls) with acls null or Collections.emptyList(); an ACL list built from configuration that parsed to zero entries; custom registry tooling that forgets to attach ACLs when creating nodes.

Common situations: Registry ACL configuration producing an empty list (empty user accounts or principal lists); code tested against an open ZK (where OPEN_ACL_UNSAFE was implicitly fine) then pointed at the secure registry; anonymous usage accidentally routed into secure path creation.

Related errors

• Parsing {} :{}
• Service {} is in wrong state: {}
• {}
• No user for ACLs determinable from current user or registry
• ACL '{}' not of expected form scheme:id

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/163b55497a18fcf6. Report an issue: GitHub.