apache/hadoop · error · AclException

The ACL operation has been rejected. Support for ACLs has b

Error message

The ACL operation has been rejected.  Support for ACLs has been disabled by setting %s to false.

What it means

Every NameNode ACL operation calls checkAclsConfigFlag before touching any path; this AclException means the NameNode was started with dfs.namenode.acls.enabled=false, so the whole ACL API surface (setAcl, getAclStatus, modifyAcl, removeAcl) is rejected regardless of arguments. The message names the exact config key. It is a deployment condition, not a per-file problem (the default for this key is true in current Hadoop).

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirAclOp.java:202

    if (aclSpec.isEmpty()) {
      unprotectedRemoveAcl(fsd, iip);
      return AclFeature.EMPTY_ENTRY_LIST;
    }

    INode inode = FSDirectory.resolveLastINode(iip);
    int snapshotId = iip.getLatestSnapshotId();
    List<AclEntry> newAcl = aclSpec;
    if (!fromEdits) {
      List<AclEntry> existingAcl = AclStorage.readINodeLogicalAcl(inode);
      newAcl = AclTransformation.replaceAclEntries(existingAcl, aclSpec);
    }
    AclStorage.updateINodeAcl(inode, newAcl, snapshotId);
    return newAcl;
  }

  private static void checkAclsConfigFlag(FSDirectory fsd) throws AclException {
    if (!fsd.isAclsEnabled()) {
      throw new AclException(String.format(
          "The ACL operation has been rejected.  "
              + "Support for ACLs has been disabled by setting %s to false.",
          DFSConfigKeys.DFS_NAMENODE_ACLS_ENABLED_KEY));
    }
  }

  private static void unprotectedRemoveAcl(FSDirectory fsd, INodesInPath iip)
      throws IOException {
    assert fsd.hasWriteLock();
    INode inode = FSDirectory.resolveLastINode(iip);
    int snapshotId = iip.getLatestSnapshotId();
    AclFeature f = inode.getAclFeature();
    if (f == null) {
      return;
    }

    FsPermission perm = inode.getFsPermission();
    List<AclEntry> featureEntries = AclStorage.getEntriesFromAclFeature(f);

View on GitHub (pinned to 2add963021)

Solutions

  1. Set dfs.namenode.acls.enabled=true in the NameNode's hdfs-site.xml and restart the NameNode - FSDirectory reads the flag once at startup, so a config reload is not enough.
  2. Verify the running NameNode actually picked it up (check the NN's effective config page/log) before retrying ACL calls.
  3. If ACLs must stay disabled, replace ACL calls in the client with POSIX permission operations (setPermission/setOwner) or OS-level group management.

Example fix

<!-- hdfs-site.xml on the NameNode, then restart the NameNode -->
<property>
  <name>dfs.namenode.acls.enabled</name>
  <value>true</value>
</property>
Defensive patterns

Strategy: validation

Validate before calling

static boolean aclsEnabled(FileSystem fs, Path probePath) {
  try {
    fs.getAclStatus(probePath);
    return true;
  } catch (AclException e) {
    return !e.getMessage().contains("has been disabled");
  } catch (IOException e) {
    return true; // unrelated failure; let the real call surface it
  }
}

Try / catch

try {
  fs.setAcl(path, entries);
} catch (AclException e) {
  if (e.getMessage().contains("has been disabled")) {
    // fall back to POSIX permissions or fail with a config fix instruction
  }
}

Prevention

When it happens

Trigger: Any ACL RPC - DistributedFileSystem.setAcl/getAclStatus/modifyAclEntries/removeAcl, WebHDFS ACL operations, or 'hdfs dfs -setfacl' / '-getfacl' - against a NameNode whose hdfs-site.xml sets dfs.namenode.acls.enabled=false.

Common situations: Hardened or minimal cluster configs that disable optional features; configs inherited from old Hadoop 2.x where the default was false; test clusters configured differently from production so code 'works locally' but fails in prod.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/22a51f87d1612f01. Report an issue: GitHub.