{"record":{"id":"36ec17b9e49895d4","repo":"apache/hadoop","slug":"invalid-acl-mask-is-required-and-cannot-be-delete","errorCode":null,"errorMessage":"Invalid ACL: mask is required and cannot be deleted.","messagePattern":"Invalid ACL: mask is required and cannot be deleted\\.","errorType":"exception","errorClass":"AclException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/AclTransformation.java","lineNumber":384,"sourceCode":"      scopeFound.add(entry.getScope());\n      if (entry.getType() == GROUP || entry.getName() != null) {\n        FsAction scopeUnionPerms = unionPerms.get(entry.getScope());\n        if (scopeUnionPerms == null) {\n          scopeUnionPerms = FsAction.NONE;\n        }\n        unionPerms.put(entry.getScope(),\n          scopeUnionPerms.or(entry.getPermission()));\n      }\n      if (entry.getName() != null) {\n        maskNeeded.add(entry.getScope());\n      }\n    }\n    // Add mask entry if needed in each scope.\n    for (AclEntryScope scope: scopeFound) {\n      if (!providedMask.containsKey(scope) && maskNeeded.contains(scope) &&\n          maskDirty.contains(scope)) {\n        // Caller explicitly removed mask entry, but it's required.\n        throw new AclException(\n          \"Invalid ACL: mask is required and cannot be deleted.\");\n      } else if (providedMask.containsKey(scope) &&\n          (!scopeDirty.contains(scope) || maskDirty.contains(scope))) {\n        // Caller explicitly provided new mask, or we are preserving the existing\n        // mask in an unchanged scope.\n        aclBuilder.add(providedMask.get(scope));\n      } else if (maskNeeded.contains(scope) || providedMask.containsKey(scope)) {\n        // Otherwise, if there are maskable entries present, or the ACL\n        // previously had a mask, then recalculate a mask automatically.\n        aclBuilder.add(new AclEntry.Builder()\n          .setScope(scope)\n          .setType(MASK)\n          .setPermission(unionPerms.get(scope))\n          .build());\n      }\n    }\n  }\n","sourceCodeStart":366,"sourceCodeEnd":402,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/AclTransformation.java#L366-L402","documentation":"Error \"Invalid ACL: mask is required and cannot be deleted.\" thrown in apache/hadoop.","triggerScenarios":"removeAcl/modifyAcl attempting to delete the mask entry from an ACL that has named user/group entries, where the mask is required.","commonSituations":"See trigger scenarios.","solutions":["Include a mask entry in the ACL when named users or groups are present; do not delete the mask entry."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}