{"record":{"id":"028df28ac70d1c82","repo":"apache/hadoop","slug":"doesn-t-support-removeaclentries","errorCode":null,"errorMessage":"{} doesn't support removeAclEntries","messagePattern":"(.+?) doesn't support removeAclEntries","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java","lineNumber":3166,"sourceCode":"  public void modifyAclEntries(Path path, List<AclEntry> aclSpec)\n      throws IOException {\n    throw new UnsupportedOperationException(getClass().getSimpleName()\n        + \" doesn't support modifyAclEntries\");\n  }\n\n  /**\n   * Removes ACL entries from files and directories.  Other ACL entries are\n   * retained.\n   *\n   * @param path Path to modify\n   * @param aclSpec List describing entries to remove\n   * @throws IOException if an ACL could not be modified\n   * @throws UnsupportedOperationException if the operation is unsupported\n   *         (default outcome).\n   */\n  public void removeAclEntries(Path path, List<AclEntry> aclSpec)\n      throws IOException {\n    throw new UnsupportedOperationException(getClass().getSimpleName()\n        + \" doesn't support removeAclEntries\");\n  }\n\n  /**\n   * Removes all default ACL entries from files and directories.\n   *\n   * @param path Path to modify\n   * @throws IOException if an ACL could not be modified\n   * @throws UnsupportedOperationException if the operation is unsupported\n   *         (default outcome).\n   */\n  public void removeDefaultAcl(Path path)\n      throws IOException {\n    throw new UnsupportedOperationException(getClass().getSimpleName()\n        + \" doesn't support removeDefaultAcl\");\n  }\n\n  /**","sourceCodeStart":3148,"sourceCodeEnd":3184,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java#L3148-L3184","documentation":"FileSystem.removeAclEntries(Path, List<AclEntry>) is optional; the base class throws UnsupportedOperationException with getClass().getSimpleName() + \" doesn't support removeAclEntries\". Only HDFS-family clients (DistributedFileSystem, WebHdfsFileSystem, HttpFSFileSystem), ABFS and pass-through wrappers implement ACL mutation; local and typical object-store connectors throw.","triggerScenarios":"Calling fs.removeAclEntries(path, aclSpec) during permission revocation on a store that never overrode it: file://, s3a://, gs://, har://, or an unmodified custom FileSystem; cleanup code that strips specific user entries after offboarding.","commonSituations":"Offboarding/revocation automation run in the wrong environment (local tests instead of the HDFS cluster); datasets moved to object stores where the ACL playbook no longer applies.","solutions":["Probe fs.hasPathCapability(path, CommonPathCapabilities.FS_ACLS) before revoking","Target the HDFS path explicitly (hdfs://nameservice/...) instead of relying on fs.defaultFS","Fall back to rewriting plain permission bits with setPermission on ACL-less stores","Catch UnsupportedOperationException and log the store as bits-only so revocation drift is visible"],"exampleFix":"// before\nfs.removeAclEntries(path, entriesToRemove); // throws on non-ACL stores\n\n// after\nif (fs.hasPathCapability(path, CommonPathCapabilities.FS_ACLS)) {\n  fs.removeAclEntries(path, entriesToRemove);\n} else {\n  fs.setPermission(path, FsPermission.createImmutable((short) 0750));\n}","handlingStrategy":"try-catch","validationCode":"if (fs.hasPathCapability(path, CommonPathCapabilities.FS_ACLS)) {\n  fs.removeAclEntries(path, entriesToRemove);\n}","typeGuard":"static boolean supportsAclRemoval(FileSystem fs) {\n  return fs instanceof DistributedFileSystem\n      || fs instanceof WebHdfsFileSystem;\n}","tryCatchPattern":"try {\n  fs.removeAclEntries(path, entries);\n} catch (UnsupportedOperationException e) {\n  LOG.warn(\"{} is ACL-less; revoke via permission bits instead\", fs.getUri());\n}","preventionTips":["Design revocation flows with a permission-bits fallback path","Scope ACL tooling to hdfs:// URIs in configuration, not hardcoded defaults","Log capability gaps during provisioning so permission drift is auditable"],"tags":["hadoop","filesystem","hdfs","acl","permissions","unsupportedoperationexception","revocation"],"backgroundTag":"filesystem-acl-unsupported","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}