{"record":{"id":"a6ecc79996f3307d","repo":"apache/hadoop","slug":"the-permission-can-t-be-null","errorCode":null,"errorMessage":"The permission can't be null","messagePattern":"The permission can't be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java","lineNumber":1218,"sourceCode":"   * Set permission of a path.\n   *\n   * @param path       The path\n   * @param permission Access permission\n   */\n  @Override\n  public void setPermission(final Path path, final FsPermission permission)\n      throws IOException {\n    LOG.debug(\"AzureBlobFileSystem.setPermission path: {}\", path);\n    TracingContext tracingContext = new TracingContext(clientCorrelationId,\n        fileSystemId, FSOperationType.SET_PERMISSION, true, tracingHeaderFormat, listener);\n\n    if (!getIsNamespaceEnabled(tracingContext)) {\n      super.setPermission(path, permission);\n      return;\n    }\n\n    if (permission == null) {\n      throw new IllegalArgumentException(\"The permission can't be null\");\n    }\n\n    // RBAC-only short-circuit: when fs.azure.rbac.only=true on an HNS-enabled\n    // account, skip the backend SetAccessControl call. Framework-generated\n    // setPermission() invocations (Spark/Hadoop commit protocols, distcp, etc.)\n    // succeed as no-ops so RBAC-only deployments are not blocked by lack of\n    // ACL-management permissions. Explicit ACL APIs are unaffected.\n    if (getAbfsStore().getAbfsConfiguration().isRbacOnlyMode()) {\n      LOG.debug(\"RBAC-only mode enabled; skipping setPermission for path: {}\", path);\n      return;\n    }\n\n    Path qualifiedPath = makeQualified(path);\n\n    try {\n      getAbfsStore().setPermission(qualifiedPath, permission, tracingContext);\n    } catch (AzureBlobFileSystemException ex) {\n      checkException(path, ex);","sourceCodeStart":1200,"sourceCodeEnd":1236,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java#L1200-L1236","documentation":"Thrown by AzureBlobFileSystem.setPermission when the FsPermission argument is null on an HNS-enabled account. Permission bits are required to build the backend SetAccessControl request, so a null cannot be applied. Non-HNS accounts delegate to the superclass and never hit this check; note that in RBAC-only mode (fs.azure.rbac.only) a valid non-null permission is accepted but the backend call is skipped as a no-op.","triggerScenarios":"Calling fs.setPermission(path, null) on an account where getIsNamespaceEnabled() returns true.","commonSituations":"Frameworks deriving the permission from configuration that returned null; forwarding FileStatus.getPermission() from another filesystem instance that yielded null; optional permission parameters defaulting to null.","solutions":["Pass an explicit FsPermission, e.g. FsPermission.valueOf(\"644\").","Derive a default from config (fs.permissions.umask-mode / FileSystem.getUMask) instead of forwarding null.","Skip the setPermission call when no permission is available."],"exampleFix":"// before\nfs.setPermission(path, requestedPermission); // may be null\n\n// after\nFsPermission perm = requestedPermission != null\n    ? requestedPermission\n    : FsPermission.getFileDefault();\nfs.setPermission(path, perm);","handlingStrategy":"validation","validationCode":"FsPermission effective = permission != null ? permission : FsPermission.getFileDefault();\nfs.setPermission(path, effective);","typeGuard":"static boolean isSettable(FsPermission p) {\n  return p != null;\n}","tryCatchPattern":"try {\n  fs.setPermission(path, permission);\n} catch (IllegalArgumentException e) {\n  // permission was null: apply a default and retry once, or fail fast\n}","preventionTips":["Never pass optional permissions through unguarded.","Derive defaults from FileSystem.getUMask(conf) or explicit config.","Remember non-HNS accounts take the superclass path, so add HNS-account tests too."],"tags":["azure-abfs","setpermission","illegal-argument","hns"],"backgroundTag":"missing-required-argument","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}