{"record":{"id":"163b55497a18fcf6","repo":"apache/hadoop","slug":"empty-acl-list","errorCode":null,"errorMessage":"Empty ACL list","messagePattern":"Empty ACL list","errorType":"exception","errorClass":"NoPathPermissionsException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/CuratorService.java","lineNumber":573,"sourceCode":"\n  /**\n   * Create a directory. It is not an error if it already exists.\n   *\n   * @param path          path to create\n   * @param mode          mode for path\n   * @param createParents flag to trigger parent creation\n   * @param acls          ACL for path\n   * @throws IOException any problem\n   */\n  public boolean zkMkPath(String path,\n      CreateMode mode,\n      boolean createParents,\n      List<ACL> acls)\n      throws IOException {\n    checkServiceLive();\n    path = createFullPath(path);\n    if (acls == null || acls.isEmpty()) {\n      throw new NoPathPermissionsException(path, \"Empty ACL list\");\n    }\n\n    try {\n      RegistrySecurity.AclListInfo aclInfo =\n          new RegistrySecurity.AclListInfo(acls);\n      if (LOG.isDebugEnabled()) {\n        LOG.debug(\"Creating path {} with mode {} and ACL {}\",\n            path, mode, aclInfo);\n      }\n      CreateBuilder createBuilder = curator.create();\n      createBuilder.withMode(mode).withACL(acls);\n      if (createParents) {\n        createBuilder.creatingParentsIfNeeded();\n      }\n      createBuilder.forPath(path);\n\n    } catch (KeeperException.NodeExistsException e) {\n      if (LOG.isDebugEnabled()) {","sourceCodeStart":555,"sourceCodeEnd":591,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/CuratorService.java#L555-L591","documentation":"CuratorService.zkMkPath refuses to create a ZooKeeper node without an ACL: if the acls argument is null or empty it throws NoPathPermissionsException(path, 'Empty ACL list') before contacting ZK. In a secure registry every created node must carry ACLs, so an empty list is treated as a permissions misconfiguration rather than defaulting to open access.","triggerScenarios":"zkMkPath(path, mode, createParents, acls) with acls null or Collections.emptyList(); an ACL list built from configuration that parsed to zero entries; custom registry tooling that forgets to attach ACLs when creating nodes.","commonSituations":"Registry ACL configuration producing an empty list (empty user accounts or principal lists); code tested against an open ZK (where OPEN_ACL_UNSAFE was implicitly fine) then pointed at the secure registry; anonymous usage accidentally routed into secure path creation.","solutions":["Pass a non-empty ACL list, e.g. built with RegistrySecurity.buildACLs/system ACLs, or ZooDefs.Ids.OPEN_ACL_UNSAFE in tests.","Fix the ACL configuration so parsing actually yields entries, and assert the parsed list is non-empty before creating nodes.","Validate acls != null && !acls.isEmpty() at the call site to fail with a clearer message."],"exampleFix":"// before\ncuratorService.zkMkPath(\"/registry/services\", CreateMode.PERSISTENT, true, Collections.emptyList()); // -> NoPathPermissionsException(\"Empty ACL list\")\n\n// after: every created node needs at least one ACL\nList<ACL> acls = registrySecurity.buildACLs(\"sasl:me@\", kerberosRealm, ZooDefs.Perms.ALL);\ncuratorService.zkMkPath(\"/registry/services\", CreateMode.PERSISTENT, true, acls);","handlingStrategy":"validation","validationCode":"Preconditions.checkArgument(acls != null && !acls.isEmpty(),\n    \"Cannot create registry node %s without ACLs\", path);\ncuratorService.zkMkPath(path, mode, createParents, acls);","typeGuard":null,"tryCatchPattern":"try {\n  curatorService.zkMkPath(path, mode, createParents, acls);\n} catch (NoPathPermissionsException e) {\n  // ACL list was null/empty: fix ACL config or pass default ACLs, then retry\n}","preventionTips":["Always derive node ACLs from RegistrySecurity (buildACLs/system ACLs) instead of hand-building lists.","Assert parsed ACL configuration is non-empty at startup, before any node creation.","In tests, pass ZooDefs.Ids.OPEN_ACL_UNSAFE explicitly rather than an empty list."],"tags":["registry","zookeeper","acl","permissions","hadoop-registry"],"backgroundTag":"empty-acl-list","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}