apache/hadoop · error · AccessControlException

"User " + pc.getUser() + " is not a super user (non-super us

Error message

"User " + pc.getUser() + " is not a super user (non-super user cannot change owner)."

What it means

setOwner implements classic UNIX chown rules: a file owner may change the group, but only a superuser may change the owner. When the requested username differs from the caller and the superuser privilege check (checkSuperuserPrivilege) fails, FSDirAttrOp.setOwner rethrows this clearer AccessControlException.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirAttrOp.java:97

    INodesInPath iip;
    boolean changed;
    fsd.writeLock();
    try {
      iip = fsd.resolvePath(pc, src, DirOp.WRITE);
      fsd.checkOwner(pc, iip);
      // At this point, the user must be either owner or super user.
      // superuser: can change owner to a different user,
      // change owner group to any group
      // owner: can't change owner to a different user but can change owner
      // group to different group that the user belongs to.
      if ((username != null && !pc.getUser().equals(username)) ||
          (group != null && !pc.isMemberOfGroup(group))) {
        try {
          // check if the user is superuser
          pc.checkSuperuserPrivilege(iip.getPath());
        } catch (AccessControlException e) {
          if (username != null && !pc.getUser().equals(username)) {
            throw new AccessControlException("User " + pc.getUser()
                + " is not a super user (non-super user cannot change owner).");
          }
          if (group != null && !pc.isMemberOfGroup(group)) {
            throw new AccessControlException(
                "User " + pc.getUser() + " does not belong to " + group);
          }
        }
      }
      changed = unprotectedSetOwner(fsd, iip, username, group);
    } finally {
      fsd.writeUnlock();
    }
    if (changed) {
      fsd.getEditLog().logSetOwner(iip.getPath(), username, group);
    }
    return fsd.getAuditFileInfo(iip);
  }

View on GitHub (pinned to 2add963021)

Solutions

Run the ownership change as the HDFS superuser (kinit as hdfs / 'sudo -u hdfs hdfs dfs -chown ...').
If only a group change was intended, pass username null: setOwner(path, null, group) - allowed for the file owner.
For recurring needs, configure hadoop proxyuser (doAs) so an approved service performs ownership changes on behalf of users instead of widening superuser access.

Example fix

// before: fails unless caller is superuser
fs.setOwner(path, "etl_svc", null);

// after: only the owner-changing call needs elevation; group change does not
if (ugi.getShortUserName().equals(currentOwner) || isSuperUser(ugi)) {
  fs.setOwner(path, "etl_svc", null); // run this branch as hdfs via doAs
} else {
  throw new AccessControlException("Only superuser may chown " + path);
}

Defensive patterns

Strategy: validation

Validate before calling

UserGroupInformation ugi = UserGroupInformation.getCurrentUser();
FileStatus st = fs.getFileStatus(path);
boolean changingOwner = newOwner != null && !ugi.getShortUserName().equals(newOwner);
if (changingOwner && !ugi.getShortUserName().equals("hdfs")) {
  throw new AccessControlException("Run chown-to-other-user as the HDFS superuser");
}
fs.setOwner(path, newOwner, group);

Try / catch

try {
  fs.setOwner(path, newOwner, null);
} catch (AccessControlException e) {
  if (e.getMessage().contains("cannot change owner")) {
    // re-run under the hdfs principal via doAs; do not strip the check
  }
}

Prevention

Run ownership-transfer steps in a dedicated elevated stage (hdfs principal / proxyuser).
Remember setOwner(path, null, group) is legal for owners - use it when only the group changes.

When it happens

Trigger: DistributedFileSystem.setOwner(path, newOwner, ...) or 'hdfs dfs -chown newuser:file' where newOwner != current caller and the caller is not the HDFS superuser (typically the 'hdfs' user) or a member of the supergroup.

Common situations: ETL pipelines trying to chown outputs to service accounts; jobs staging data as one user then transferring ownership to another; directory-restructuring scripts run with ordinary user credentials.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/eabeed16d4b7cf4a. Report an issue: GitHub.