{"record":{"id":"22a51f87d1612f01","repo":"apache/hadoop","slug":"the-acl-operation-has-been-rejected-support-for","errorCode":null,"errorMessage":"The ACL operation has been rejected.  Support for ACLs has been disabled by setting %s to false.","messagePattern":"The ACL operation has been rejected\\.  Support for ACLs has been disabled by setting (.+?) to false\\.","errorType":"exception","errorClass":"AclException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirAclOp.java","lineNumber":202,"sourceCode":"    if (aclSpec.isEmpty()) {\n      unprotectedRemoveAcl(fsd, iip);\n      return AclFeature.EMPTY_ENTRY_LIST;\n    }\n\n    INode inode = FSDirectory.resolveLastINode(iip);\n    int snapshotId = iip.getLatestSnapshotId();\n    List<AclEntry> newAcl = aclSpec;\n    if (!fromEdits) {\n      List<AclEntry> existingAcl = AclStorage.readINodeLogicalAcl(inode);\n      newAcl = AclTransformation.replaceAclEntries(existingAcl, aclSpec);\n    }\n    AclStorage.updateINodeAcl(inode, newAcl, snapshotId);\n    return newAcl;\n  }\n\n  private static void checkAclsConfigFlag(FSDirectory fsd) throws AclException {\n    if (!fsd.isAclsEnabled()) {\n      throw new AclException(String.format(\n          \"The ACL operation has been rejected.  \"\n              + \"Support for ACLs has been disabled by setting %s to false.\",\n          DFSConfigKeys.DFS_NAMENODE_ACLS_ENABLED_KEY));\n    }\n  }\n\n  private static void unprotectedRemoveAcl(FSDirectory fsd, INodesInPath iip)\n      throws IOException {\n    assert fsd.hasWriteLock();\n    INode inode = FSDirectory.resolveLastINode(iip);\n    int snapshotId = iip.getLatestSnapshotId();\n    AclFeature f = inode.getAclFeature();\n    if (f == null) {\n      return;\n    }\n\n    FsPermission perm = inode.getFsPermission();\n    List<AclEntry> featureEntries = AclStorage.getEntriesFromAclFeature(f);","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirAclOp.java#L184-L220","documentation":"Every NameNode ACL operation calls checkAclsConfigFlag before touching any path; this AclException means the NameNode was started with dfs.namenode.acls.enabled=false, so the whole ACL API surface (setAcl, getAclStatus, modifyAcl, removeAcl) is rejected regardless of arguments. The message names the exact config key. It is a deployment condition, not a per-file problem (the default for this key is true in current Hadoop).","triggerScenarios":"Any ACL RPC - DistributedFileSystem.setAcl/getAclStatus/modifyAclEntries/removeAcl, WebHDFS ACL operations, or 'hdfs dfs -setfacl' / '-getfacl' - against a NameNode whose hdfs-site.xml sets dfs.namenode.acls.enabled=false.","commonSituations":"Hardened or minimal cluster configs that disable optional features; configs inherited from old Hadoop 2.x where the default was false; test clusters configured differently from production so code 'works locally' but fails in prod.","solutions":["Set dfs.namenode.acls.enabled=true in the NameNode's hdfs-site.xml and restart the NameNode - FSDirectory reads the flag once at startup, so a config reload is not enough.","Verify the running NameNode actually picked it up (check the NN's effective config page/log) before retrying ACL calls.","If ACLs must stay disabled, replace ACL calls in the client with POSIX permission operations (setPermission/setOwner) or OS-level group management."],"exampleFix":"<!-- hdfs-site.xml on the NameNode, then restart the NameNode -->\n<property>\n  <name>dfs.namenode.acls.enabled</name>\n  <value>true</value>\n</property>","handlingStrategy":"validation","validationCode":"static boolean aclsEnabled(FileSystem fs, Path probePath) {\n  try {\n    fs.getAclStatus(probePath);\n    return true;\n  } catch (AclException e) {\n    return !e.getMessage().contains(\"has been disabled\");\n  } catch (IOException e) {\n    return true; // unrelated failure; let the real call surface it\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  fs.setAcl(path, entries);\n} catch (AclException e) {\n  if (e.getMessage().contains(\"has been disabled\")) {\n    // fall back to POSIX permissions or fail with a config fix instruction\n  }\n}","preventionTips":["Verify dfs.namenode.acls.enabled on the NameNode (not just client config) before shipping ACL features.","Cache the probe result; the flag only changes on NN restart.","Include an ACL smoke test in cluster validation pipelines."],"tags":["hdfs","acl","namenode","config"],"backgroundTag":"feature-disabled-by-config","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}