apache/hadoop · error · IOException

Invalid permissions mode provided while trying to createPerm

Error message

Invalid permissions mode provided while trying to createPermissions

What it means

LocalKeyStoreProvider.createPermissions() parses its argument as a base-8 integer (Integer.parseInt(perms, 8)); a NumberFormatException is wrapped into this IOException. In stock Hadoop the caller passes the constant '600' and can never fail - this error only fires in a subclass or caller that passes a non-octal permission string (e.g. 'rw-------', '0x1C0', empty).

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/LocalKeyStoreProvider.java:86

  @Override
  protected boolean keystoreExists() throws IOException {
    /* The keystore loader doesn't handle zero length files. */
    return file.exists() && (file.length() > 0);
  }

  @Override
  protected InputStream getInputStreamForFile() throws IOException {
    InputStream is = Files.newInputStream(file.toPath());
    return is;
  }

  @Override
  protected void createPermissions(String perms) throws IOException {
    int mode = 700;
    try {
      mode = Integer.parseInt(perms, 8);
    } catch (NumberFormatException nfe) {
      throw new IOException("Invalid permissions mode provided while "
          + "trying to createPermissions", nfe);
    }
    permissions = modeToPosixFilePermission(mode);
  }

  @Override
  protected void stashOriginalFilePermissions() throws IOException {
    // save off permissions in case we need to
    // rewrite the keystore in flush()
    if (!Shell.WINDOWS) {
      Path path = Paths.get(file.getCanonicalPath());
      permissions = Files.getPosixFilePermissions(path);
    } else {
      // On Windows, the JDK does not support the POSIX file permission APIs.
      // Instead, we can do a winutils call and translate.
      String[] cmd = Shell.getGetPermissionCommand();
      String[] args = new String[cmd.length + 1];
      System.arraycopy(cmd, 0, args, 0, cmd.length);

View on GitHub (pinned to 2add963021)

Solutions

1. Pass strictly octal digit strings: '600', '640', '440', '700'
2. Validate before calling: perms.matches("[0-7]{3,4}")
3. Convert symbolic modes to octal in your layer (FsPermission.valueOf(...).toOctal()) before invoking createPermissions

Example fix

// before (custom subclass)
createPermissions("rw-------");   // NumberFormatException -> IOException

// after
createPermissions(FsPermission.valueOf("rw-------").toOctal());   // "600"

// Subclass authors: validate the mode string before calling createPermissions
static void assertOctalMode(String perms) {
  if (perms == null || !perms.matches("[0-7]{3,4}")) {
    throw new IllegalArgumentException("Permission mode must be octal digits, e.g. 600: " + perms);
  }
}

boolean isValidOctalMode(String perms) {
  return perms != null && perms.matches("[0-7]{3,4}");
}

try {
  createPermissions(perms);
} catch (IOException ex) {
  if (ex.getCause() instanceof NumberFormatException) {
    // caller passed a non-octal mode string; fix the value, do not retry with the same input
  } else { throw ex; }
}

When it happens

Trigger: A custom subclass of LocalKeyStoreProvider/AbstractJavaKeyStoreProvider overriding the caller and passing symbolic or hex permission strings; refactoring that turns '600' into a symbolic mode; passing a permissions string sourced from config without validation.

Common situations: Teams extending the credential provider SPI; porting code that stored permissions as 'rwx------' strings; config-driven permission values injected unvalidated.

Related errors

• Perms option is set multiple times
• no permission supplied
• Mkdirs failed to create {} (exists={}, cwd={})
• Permission denied: user=%s, path="%s":%s:%s:%s%s
• {} doesn't support modifyAclEntries

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/f576190129e653b8. Report an issue: GitHub.