{"record":{"id":"825309f52b1971da","repo":"apache/hadoop","slug":"the-xattr-security-hdfs-unreadable-by-superuser","errorCode":null,"errorMessage":"The xattr 'security.hdfs.unreadable.by.superuser' can not be deleted.","messagePattern":"The xattr 'security\\.hdfs\\.unreadable\\.by\\.superuser' can not be deleted\\.","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirXAttrOp.java","lineNumber":249,"sourceCode":"    throws AccessControlException {\n    if (existingXAttrs == null || existingXAttrs.isEmpty() ||\n        toFilter == null || toFilter.isEmpty()) {\n      return existingXAttrs;\n    }\n\n    // Populate a new list with XAttrs that pass the filter\n    List<XAttr> newXAttrs =\n        Lists.newArrayListWithCapacity(existingXAttrs.size());\n    for (XAttr a : existingXAttrs) {\n      boolean add = true;\n      for (ListIterator<XAttr> it = toFilter.listIterator(); it.hasNext()\n          ;) {\n        XAttr filter = it.next();\n        Preconditions.checkArgument(\n            !KEYID_XATTR.equalsIgnoreValue(filter),\n            \"The encryption zone xattr should never be deleted.\");\n        if (UNREADABLE_BY_SUPERUSER_XATTR.equalsIgnoreValue(filter)) {\n          throw new AccessControlException(\"The xattr '\" +\n              SECURITY_XATTR_UNREADABLE_BY_SUPERUSER + \"' can not be deleted.\");\n        }\n        if (a.equalsIgnoreValue(filter)) {\n          add = false;\n          it.remove();\n          filtered.add(filter);\n          break;\n        }\n      }\n      if (add) {\n        newXAttrs.add(a);\n      }\n    }\n\n    return newXAttrs;\n  }\n\n  public static INode unprotectedSetXAttrs(","sourceCodeStart":231,"sourceCodeEnd":267,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSDirXAttrOp.java#L231-L267","documentation":"security.hdfs.unreadable.by.superuser is an internal protection flag: once set by a privileged client it hides the file's content even from the HDFS superuser. unprotectedRemoveXAttrs rejects any removal attempt with AccessControlException; there is deliberately no API to delete it, because that would defeat its security purpose. The adjacent guard likewise forbids deleting the encryption-zone key id xattr.","triggerScenarios":"removeXAttr (or bulk delete-all-xattrs logic) that includes security.hdfs.unreadable.by.superuser in the list; the same method also rejects the raw encryption-zone keyid xattr via Preconditions.","commonSituations":"Generic xattr dump/restore, anonymization, or cleanup tools that enumerate and strip every attribute; migration scripts that try to normalize xattrs across trees.","solutions":["Skip protected attributes in removal loops: never touch security.hdfs.unreadable.by.superuser, and filter raw./system. namespaces","To actually drop the protection, copy the file content to a new file (the xattr does not carry over) and swap names","Fix bulk tooling to filter xattrs by namespace before calling removeXAttr"],"exampleFix":"// before: strip everything\nfor (String name : fs.listXAttrs(path)) {\n  fs.removeXAttr(path, name); // AccessControlException on protected xattr\n}\n\n// after: skip protected/internal namespaces\nfor (String name : fs.listXAttrs(path)) {\n  if (!name.startsWith(\"security.\") && !name.startsWith(\"system.\")\n      && !name.startsWith(\"raw.\")) {\n    fs.removeXAttr(path, name);\n  }\n}","handlingStrategy":"validation","validationCode":"for (String name : fs.listXAttrs(path)) {\n  if (!isProtectedXattr(name)) {\n    fs.removeXAttr(path, name);\n  }\n}","typeGuard":"static boolean isProtectedXattr(String name) {\n  return \"security.hdfs.unreadable.by.superuser\".equals(name)\n      || name.startsWith(\"system.\")\n      || name.startsWith(\"raw.\");\n}","tryCatchPattern":"try {\n  fs.removeXAttr(path, name);\n} catch (AccessControlException e) {\n  // protected attribute: skip it in bulk-removal loops instead of failing\n}","preventionTips":["Never include security.hdfs.unreadable.by.superuser or raw./system. xattrs in removal sets","Filter by namespace in bulk tools before calling removeXAttr","To drop the protection, copy file content to a new file rather than deleting the attribute"],"tags":["hdfs","xattr","security","access-control","protected-attribute"],"backgroundTag":"protected-attribute-modification","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}