{"record":{"id":"14bcd3b6c3a3fe87","repo":"apache/hadoop","slug":"doesn-t-support-modifyaclentries","errorCode":null,"errorMessage":"{} doesn't support modifyAclEntries","messagePattern":"(.+?) doesn't support modifyAclEntries","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java","lineNumber":3150,"sourceCode":"    throw new UnsupportedOperationException(getClass().getSimpleName()\n        + \" doesn't support deleteSnapshot\");\n  }\n\n  /**\n   * Modifies ACL entries of files and directories.  This method can add new ACL\n   * entries or modify the permissions on existing ACL entries.  All existing\n   * ACL entries that are not specified in this call are retained without\n   * changes.  (Modifications are merged into the current ACL.)\n   *\n   * @param path Path to modify\n   * @param aclSpec List&lt;AclEntry&gt; describing modifications\n   * @throws IOException if an ACL could not be modified\n   * @throws UnsupportedOperationException if the operation is unsupported\n   *         (default outcome).\n   */\n  public void modifyAclEntries(Path path, List<AclEntry> aclSpec)\n      throws IOException {\n    throw new UnsupportedOperationException(getClass().getSimpleName()\n        + \" doesn't support modifyAclEntries\");\n  }\n\n  /**\n   * Removes ACL entries from files and directories.  Other ACL entries are\n   * retained.\n   *\n   * @param path Path to modify\n   * @param aclSpec List describing entries to remove\n   * @throws IOException if an ACL could not be modified\n   * @throws UnsupportedOperationException if the operation is unsupported\n   *         (default outcome).\n   */\n  public void removeAclEntries(Path path, List<AclEntry> aclSpec)\n      throws IOException {\n    throw new UnsupportedOperationException(getClass().getSimpleName()\n        + \" doesn't support removeAclEntries\");\n  }","sourceCodeStart":3132,"sourceCodeEnd":3168,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java#L3132-L3168","documentation":"FileSystem.modifyAclEntries(Path, List<AclEntry>) is optional; the base class throws UnsupportedOperationException with getClass().getSimpleName() + \" doesn't support modifyAclEntries\". ACL APIs are implemented by HDFS-family clients (DistributedFileSystem, WebHdfsFileSystem, HttpFSFileSystem), azurebfs (ABFS maps ACLs to the account's POSIX ACLs) and view/chroot/filter pass-throughs. RawLocalFileSystem and S3A/GCS do not implement them, so they inherit the throwing default.","triggerScenarios":"Calling fs.modifyAclEntries(path, aclSpec) on file://, s3a://, gs://, har://, or a custom FileSystem without the override; security-provisioning code that grants per-user ACLs unconditionally at dataset creation.","commonSituations":"ACL provisioning tooling written for HDFS and run in local unit tests; data-lake permission scripts reused after migrating a dataset from HDFS to S3; distcp -p (preserve acl) targeting a non-supporting filesystem.","solutions":["Probe capability first: fs.hasPathCapability(path, CommonPathCapabilities.FS_ACLS)","On stores without ACLs, fall back to POSIX bits via setPermission/setOwner — those are universally implemented","Catch UnsupportedOperationException and record that the store is permission-bits-only; do not retry","With distcp, drop the acl/xattr preservation flags when the target cannot honor them"],"exampleFix":"// before\nfs.modifyAclEntries(path, Collections.singletonList(\n    AclEntry.parseAclEntry(\"user:analyst:rwx\", true)));\n// UnsupportedOperationException on LocalFileSystem/S3A\n\n// after\nif (fs.hasPathCapability(path, CommonPathCapabilities.FS_ACLS)) {\n  fs.modifyAclEntries(path, aclSpec);\n} else {\n  fs.setPermission(path, FsPermission.valueOf(\"rwxr-x---\")); // bits fallback\n}","handlingStrategy":"try-catch","validationCode":"import org.apache.hadoop.fs.CommonPathCapabilities;\n\nif (fs.hasPathCapability(path, CommonPathCapabilities.FS_ACLS)) {\n  fs.modifyAclEntries(path, aclSpec);\n} else {\n  fs.setPermission(path, fallbackPermission);\n}","typeGuard":"static boolean supportsAcls(FileSystem fs) {\n  return fs instanceof DistributedFileSystem\n      || fs instanceof WebHdfsFileSystem;\n}","tryCatchPattern":"try {\n  fs.modifyAclEntries(path, aclSpec);\n} catch (UnsupportedOperationException e) {\n  // class in e.getMessage() is bits-only: degrade to setPermission\n}","preventionTips":["Capability-probe once per path root and branch provisioning logic accordingly","In local unit tests, expect ACL APIs to throw; test them against MiniDFSCluster instead","distcp: skip -p acl/xattr preservation for non-HDFS endpoints"],"tags":["hadoop","filesystem","hdfs","acl","permissions","unsupportedoperationexception"],"backgroundTag":"filesystem-acl-unsupported","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}