{"record":{"id":"13fb2557d0531930","repo":"apache/hadoop","slug":"removeacl-is-only-supported-by-storage-accounts-wi","errorCode":null,"errorMessage":"removeAcl is only supported by storage accounts with the hierarchical namespace enabled.","messagePattern":"removeAcl is only supported by storage accounts with the hierarchical namespace enabled\\.","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java","lineNumber":1356,"sourceCode":"  }\n\n  /**\n   * Removes all but the base ACL entries of files and directories.  The entries\n   * for user, group, and others are retained for compatibility with permission\n   * bits.\n   *\n   * @param path Path to modify\n   * @throws IOException if an ACL could not be removed\n   */\n  @Override\n  public void removeAcl(final Path path) throws IOException {\n    LOG.debug(\"AzureBlobFileSystem.removeAcl path: {}\", path);\n    TracingContext tracingContext = new TracingContext(clientCorrelationId,\n        fileSystemId, FSOperationType.REMOVE_ACL, true, tracingHeaderFormat,\n        listener);\n\n    if (!getIsNamespaceEnabled(tracingContext)) {\n      throw new UnsupportedOperationException(\n          \"removeAcl is only supported by storage accounts with the \"\n              + \"hierarchical namespace enabled.\");\n    }\n\n    Path qualifiedPath = makeQualified(path);\n\n    try {\n      getAbfsStore().removeAcl(qualifiedPath, tracingContext);\n    } catch (AzureBlobFileSystemException ex) {\n      checkException(path, ex);\n    }\n  }\n\n  /**\n   * Fully replaces ACL of files and directories, discarding all existing\n   * entries.\n   *\n   * @param path    Path to modify","sourceCodeStart":1338,"sourceCodeEnd":1374,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java#L1338-L1374","documentation":"Thrown by AzureBlobFileSystem.removeAcl when the storage account lacks hierarchical namespace. Removing all ACLs (reverting to base permission bits) is only meaningful on HNS accounts; flat accounts are rejected before any request is sent. The namespace state is resolved once and cached per filesystem instance.","triggerScenarios":"Calling fs.removeAcl(path) against a non-HNS (flat namespace) ABFS account.","commonSituations":"Running setfacl -b / acl-reset tooling copied from HDFS workflows; jobs shared across mounts where one account is flat; emulators that do not implement HNS.","solutions":["Target an HNS-enabled storage account.","Skip or conditionalize the removeAcl step for flat accounts.","Catch UnsupportedOperationException and continue without ACL stripping."],"exampleFix":"// before\nfs.removeAcl(path);\n\n// after\ntry {\n  fs.removeAcl(path);\n} catch (UnsupportedOperationException e) {\n  LOG.warn(\"removeAcl unsupported without hierarchical namespace: {}\", path);\n}","handlingStrategy":"try-catch","validationCode":"static boolean isAclCapable(FileSystem fs) {\n  try {\n    fs.getAclStatus(new Path(\"/\"));\n    return true;\n  } catch (UnsupportedOperationException e) {\n    return false;\n  } catch (IOException e) {\n    return true;\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  fs.removeAcl(path);\n} catch (UnsupportedOperationException e) {\n  LOG.warn(\"removeAcl unsupported without HNS: {}\", path);\n}","preventionTips":["Verify the account has HNS before running ACL-reset jobs.","Prefer removeAcl over empty setAcl for clearing.","Keep HDFS-derived ACL scripts behind a filesystem-capability check."],"tags":["azure-abfs","acl","hierarchical-namespace","unsupported-operation"],"backgroundTag":"unsupported-filesystem-operation","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}