apache/hadoop · error · HadoopIllegalArgumentException

Expected one of -b, -k, -m, -x or --set options

Error message

Expected one of -b, -k, -m, -x or --set options

What it means

Setfacl.processOptions throws HadoopIllegalArgumentException('Expected one of -b, -k, -m, -x or --set options') when no operation flag at all was supplied. setfacl never operates without a mode: it does not display ACLs (that is getfacl) and has no default action.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/shell/AclCommands.java:233

          throw new HadoopIllegalArgumentException(
              "Missing either <acl_spec> or <path>");
        }
        aclEntries = AclEntry.parseAclSpec(args.removeFirst(), !cf.getOpt("x"));
        if (aclEntries.isEmpty()) {
          throw new HadoopIllegalArgumentException(
              "Missing <acl_spec> entry");
        }
      }

      if (args.isEmpty()) {
        throw new HadoopIllegalArgumentException("<path> is missing");
      }
      if (args.size() > 1) {
        throw new HadoopIllegalArgumentException("Too many arguments");
      }

      if (!hasExpectedOptions) {
        throw new HadoopIllegalArgumentException(
            "Expected one of -b, -k, -m, -x or --set options");
      }
      // In recursive mode, save a separate list of just the access ACL entries.
      // Only directories may have a default ACL.  When a recursive operation
      // encounters a file under the specified path, it must pass only the
      // access ACL entries.
      if (isRecursive() && (oneModifyOption || setOption)) {
        accessAclEntries = Lists.newArrayList();
        for (AclEntry entry: aclEntries) {
          if (entry.getScope() == AclEntryScope.ACCESS) {
            accessAclEntries.add(entry);
          }
        }
      }
    }

    @Override
    protected void processPath(PathData item) throws IOException {

View on GitHub (pinned to 2add963021)

Solutions

1. Add the intended mode flag: -b (remove all ACLs), -k (remove default ACL), -m (modify entries), -x (remove specific entries), or --set (replace the full ACL).
2. If the goal was to view ACLs, use hadoop fs -getfacl instead.

Example fix

# before
hadoop fs -setfacl /data

# after
hadoop fs -setfacl -m user:tom:r-- /data   # or -b / -k / -x / --set

case "$MODE" in
  -b|-k) hadoop fs -setfacl "$MODE" "$TARGET";;
  -m|-x|--set) hadoop fs -setfacl "$MODE" "$SPEC" "$TARGET";;
  *) echo "setfacl requires one of -b -k -m -x --set" >&2; exit 2;;
esac

When it happens

Trigger: 'hadoop fs -setfacl /data' — a lone path with none of -b, -k, -m, -x, or --set present, so hasExpectedOptions at AclCommands.java:233 is false.

Common situations: Users assuming setfacl without flags prints or refreshes ACLs; commands built programmatically where the mode flag variable was dropped; confusion with the Linux setfacl habit of always passing a flag (the Hadoop command enforces the same but the error text differs).

Related errors

• Specified flags contains both remove and modify flags
• Missing arguments: <acl_spec> <path>
• Missing either <acl_spec> or <path>
• Missing <acl_spec> entry
• <path> is missing

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/1389c9b54806e42f. Report an issue: GitHub.