apache/hadoop · error · IllegalArgumentException

The aclSpec argument is invalid.

Error message

The aclSpec argument is invalid.

What it means

Thrown by AzureBlobFileSystem.removeAclEntries when the aclSpec list is null or empty (on an HNS account). There is nothing to remove, so the driver rejects the call before any service request. Distinct from the UnsupportedOperationException that fires first on non-HNS accounts.

Source

Thrown at hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java:1300

   * @param aclSpec List of AclEntry describing entries to remove
   * @throws IOException if an ACL could not be modified
   */
  @Override
  public void removeAclEntries(final Path path, final List<AclEntry> aclSpec)
      throws IOException {
    LOG.debug("AzureBlobFileSystem.removeAclEntries path: {}", path);
    TracingContext tracingContext = new TracingContext(clientCorrelationId,
        fileSystemId, FSOperationType.REMOVE_ACL_ENTRIES, true,
        tracingHeaderFormat, listener);

    if (!getIsNamespaceEnabled(tracingContext)) {
      throw new UnsupportedOperationException(
          "removeAclEntries is only supported by storage accounts with the "
              + "hierarchical namespace enabled.");
    }

    if (aclSpec == null || aclSpec.isEmpty()) {
      throw new IllegalArgumentException("The aclSpec argument is invalid.");
    }

    Path qualifiedPath = makeQualified(path);

    try {
      getAbfsStore().removeAclEntries(qualifiedPath, aclSpec, tracingContext);
    } catch (AzureBlobFileSystemException ex) {
      checkException(path, ex);
    }
  }

  /**
   * Removes all default ACL entries from files and directories.
   *
   * @param path Path to modify
   * @throws IOException if an ACL could not be modified
   */
  @Override

View on GitHub (pinned to 2add963021)

Solutions

1. Skip the call when the list is null or empty.
2. Fix the diff/parse logic that produced an empty entry list.
3. Log the computed entry list before invoking to catch regressions.

Example fix

// before
fs.removeAclEntries(path, toRemove);

// after
if (toRemove != null && !toRemove.isEmpty()) {
  fs.removeAclEntries(path, toRemove);
}

if (aclSpec == null || aclSpec.isEmpty()) {
  return; // nothing to remove
}
fs.removeAclEntries(path, aclSpec);

static boolean isNonEmpty(List<AclEntry> l) {
  return l != null && !l.isEmpty();
}

try {
  fs.removeAclEntries(path, aclSpec);
} catch (IllegalArgumentException e) {
  // fix the diff logic that produced an empty list
}

When it happens

Trigger: Calling fs.removeAclEntries(path, null) or with an empty List<AclEntry>.

Common situations: Computing entries-to-remove via set difference that yields an empty set; conditional ACL logic where the spec parameter is never populated; passing a parsed spec that failed silently.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• A valid owner or group must be specified.
• The value of the aclSpec parameter is invalid.
• A valid name and value must be specified.
• A valid name must be specified.
• The permission can't be null

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/86a1730840168487. Report an issue: GitHub.