apache/hadoop · error · AccessControlException

Permission denied while accessing pool {}: user {} does not

Error message

Permission denied while accessing pool {}: user {} does not have {} permissions.

What it means

Error "Permission denied while accessing pool {}: user {} does not have {} permissions." thrown in apache/hadoop.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSPermissionChecker.java:844

      throws AccessControlException {
    FsPermission mode = pool.getMode();
    if (isSuperUser()) {
      return;
    }
    if (getUser().equals(pool.getOwnerName())
        && mode.getUserAction().implies(access)) {
      return;
    }
    if (isMemberOfGroup(pool.getGroupName())
        && mode.getGroupAction().implies(access)) {
      return;
    }
    if (!getUser().equals(pool.getOwnerName())
        && !isMemberOfGroup(pool.getGroupName())
        && mode.getOtherAction().implies(access)) {
      return;
    }
    throw new AccessControlException("Permission denied while accessing pool "
        + pool.getPoolName() + ": user " + getUser() + " does not have "
        + access.toString() + " permissions.");
  }

  /**
   * Verifies that all existing ancestors are directories.  If a permission
   * checker is provided then the user must have exec access.  Ancestor
   * symlinks will throw an unresolved exception, and resolveLink determines
   * if the last inode will throw an unresolved exception.  This method
   * should always be called after a path is resolved into an IIP.
   * @param pc for permission checker, null for no checking
   * @param iip path to verify
   * @param resolveLink whether last inode may be a symlink
   * @throws AccessControlException
   * @throws UnresolvedPathException
   * @throws ParentNotDirectoryException
   */
  static void checkTraverse(FSPermissionChecker pc, INodesInPath iip,

View on GitHub (pinned to 2add963021)

Solutions

1. Grant the user the required permission on the storage pool (via dfs.namenode.posix.acl.inheritance or admin config) or use an authorized account.

When it happens

Trigger: A user accesses a snapshot diff/Listing on a block pool or storage pool without the required pool-level permission.

Common situations: Snapshot-diff or pool-scoped admin operations by a user lacking pool ACL permissions.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/f03a8e56047fa499. Report an issue: GitHub.