apache/hadoop · error · UnsupportedOperationException

getAclStatus is only supported by storage account with the h

Error message

getAclStatus is only supported by storage account with the hierarchical namespace enabled.

What it means

Thrown by AzureBlobFileSystem.getAclStatus when the storage account lacks hierarchical namespace. Reading ACLs is only defined on HNS accounts; on flat accounts there are no POSIX ACLs to return, so the driver throws UnsupportedOperationException client-side. This is the standard feature probe: many callers test getAclStatus in a try/catch to detect HNS support.

Source

Thrown at hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java:1421

      checkException(path, ex);
    }
  }

  /**
   * Gets the ACL of a file or directory.
   *
   * @param path Path to get
   * @return AbfsAclStatus describing the ACL of the file or directory
   * @throws IOException if an ACL could not be read
   */
  @Override
  public AclStatus getAclStatus(final Path path) throws IOException {
    LOG.debug("AzureBlobFileSystem.getAclStatus path: {}", path);
    TracingContext tracingContext = new TracingContext(clientCorrelationId,
        fileSystemId, FSOperationType.GET_ACL_STATUS, true, tracingHeaderFormat, listener);

    if (!getIsNamespaceEnabled(tracingContext)) {
      throw new UnsupportedOperationException(
          "getAclStatus is only supported by storage account with the "
              + "hierarchical namespace enabled.");
    }

    Path qualifiedPath = makeQualified(path);

    try {
      return getAbfsStore().getAclStatus(qualifiedPath, tracingContext);
    } catch (AzureBlobFileSystemException ex) {
      checkException(path, ex);
      return null;
    }
  }

  /**
   * Checks if the user can access a path.  The mode specifies which access
   * checks to perform.  If the requested permissions are granted, then the
   * method returns normally.  If access is denied, then the method throws an

View on GitHub (pinned to 2add963021)

Solutions

Use an HNS-enabled account when ACL inspection is required.
Feature-detect once per filesystem via a guarded getAclStatus call and cache the result.
Fall back to getFileStatus().getPermission() for basic permission bits on flat accounts.

Example fix

// before
AclStatus acl = fs.getAclStatus(path);

// after
AclStatus acl;
try {
  acl = fs.getAclStatus(path);
} catch (UnsupportedOperationException e) {
  acl = null; // flat account: only permission bits available
}

Defensive patterns

Strategy: try-catch

Validate before calling

static boolean isAclCapable(FileSystem fs) {
  try {
    fs.getAclStatus(new Path("/"));
    return true;
  } catch (UnsupportedOperationException e) {
    return false;
  } catch (IOException e) {
    return true;
  }
}

Try / catch

try {
  return fs.getAclStatus(path);
} catch (UnsupportedOperationException e) {
  return null; // flat account: only permission bits available via getFileStatus
}

Prevention

Use getAclStatus-on-root as the one-time HNS feature probe.
Fall back to getFileStatus().getPermission() when ACLs are unsupported.
Do not assume every FileSystem implements AclSource.

When it happens

Trigger: Calling fs.getAclStatus(path) against a non-HNS ABFS account.

Common situations: ACL viewers/reporting tools enumerating permissions; authorization plugins reading ACLs; code assuming every FileSystem implements AclSource.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/bad414b526d1758c. Report an issue: GitHub.