{"record":{"id":"00b82e47301d718c","repo":"apache/hadoop","slug":"access-denied-for-user-pc-getuser-supe","errorCode":null,"errorMessage":"\"Access denied for user \" + pc.getUser() + \". Superuser or owner of parent folder privilege is required\"","messagePattern":"\"Access denied for user \" \\+ pc\\.getUser\\(\\) \\+ \"\\. Superuser or owner of parent folder privilege is required\"","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirAttrOp.java","lineNumber":252,"sourceCode":"  /**\n   * Set the namespace, storagespace and typespace quota for a directory.\n   *\n   * Note: This does not support \".inodes\" relative path.\n   */\n  static void setQuota(FSDirectory fsd, FSPermissionChecker pc, String src,\n      long nsQuota, long ssQuota, StorageType type, boolean allowOwner)\n      throws IOException {\n\n    fsd.writeLock();\n    try {\n      INodesInPath iip = fsd.resolvePath(pc, src, DirOp.WRITE);\n      // Here, the assumption is that the caller of this method has\n      // already checked for super user privilege\n      if (fsd.isPermissionEnabled() && !pc.isSuperUser() && allowOwner) {\n        try {\n          fsd.checkOwner(pc, iip.getParentINodesInPath());\n        } catch(AccessControlException ace) {\n          throw new AccessControlException(\n              \"Access denied for user \" + pc.getUser() +\n              \". Superuser or owner of parent folder privilege is required\");\n        }\n      }\n      INodeDirectory changed =\n          unprotectedSetQuota(fsd, iip, nsQuota, ssQuota, type);\n      if (changed != null) {\n        final QuotaCounts q = changed.getQuotaCounts();\n        if (type == null) {\n          fsd.getEditLog().logSetQuota(src, q.getNameSpace(), q.getStorageSpace());\n        } else {\n          fsd.getEditLog().logSetQuotaByStorageType(\n              src, q.getTypeSpaces().get(type), type);\n        }\n      }\n    } finally {\n      fsd.writeUnlock();\n    }","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirAttrOp.java#L234-L270","documentation":"Quota changes are superuser-only by default; when dfs.permissions.allow.owner.set.quota=true, non-superusers are allowed but must own the parent directory of the target (checkOwner on iip.getParentINodesInPath()). FSDirAttrOp.setQuota catches the failed owner check and rethrows this clearer AccessControlException naming the required privilege.","triggerScenarios":"HdfsAdmin.setQuota / 'hdfs dfsadmin -setQuota' or '-setSpaceQuota' by a user who is neither superuser nor owner of the target directory's parent - note the check is on the PARENT's owner, so owning the target dir itself is not enough.","commonSituations":"Self-service quota administration enabled (allow.owner.set.quota=true) without chowning parent dirs to the responsible users; department admins on shared trees like /shared/<team> where /shared is owned by hdfs.","solutions":["Run the quota change as the HDFS superuser (hdfs user).","If owner-based quota self-service is intended, have the superuser chown the parent directory to the responsible user once, and keep dfs.permissions.allow.owner.set.quota=true.","For service accounts, use proxy-user (doAs) delegation instead of granting superuser credentials."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"UserGroupInformation ugi = UserGroupInformation.getCurrentUser();\nif (!ugi.isSuperUser()) { // heuristic: check against your superuser/supergroup\n  FileStatus parent = fs.getFileStatus(path.getParent());\n  if (!ugi.getShortUserName().equals(parent.getOwner())) {\n    throw new AccessControlException(\"Quota change on \" + path\n        + \" requires superuser or ownership of parent \" + parent.getPath());\n  }\n}\nnew HdfsAdmin(path.toUri(), fs.getConf()).setQuota(path, quota);","typeGuard":null,"tryCatchPattern":"try {\n  admin.setQuota(path, quota);\n} catch (AccessControlException e) {\n  if (e.getMessage().contains(\"owner of parent folder\")) {\n    // rerun as hdfs, or have admin chown the parent to this user first\n  }\n}","preventionTips":["When enabling dfs.permissions.allow.owner.set.quota, also chown the parent dirs to the responsible users.","Remember the rule is ownership of the PARENT directory, not the target."],"tags":["hdfs","quota","permissions","access-control"],"backgroundTag":"permission-denied-superuser-required","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}