{"record":{"id":"d1a2c664863e7b79","repo":"apache/hadoop","slug":"invalid-acl-acl-has-accessentries-size-access","errorCode":null,"errorMessage":"Invalid ACL: ACL has {accessEntries.size()} access entries, which exceeds maximum of {MAX_ENTRIES}.","messagePattern":"Invalid ACL: ACL has (.+?) access entries, which exceeds maximum of (.+?)\\.","errorType":"exception","errorClass":"AclException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/AclTransformation.java","lineNumber":324,"sourceCode":"          .setType(type).build();\n        if (Collections.binarySearch(scopedEntries.getDefaultEntries(),\n            defaultEntryKey, ACL_ENTRY_COMPARATOR) < 0) {\n          throw new AclException(\n            \"Invalid default ACL: the user, group and other entries are required.\");\n        }\n      }\n    }\n    return Collections.unmodifiableList(aclBuilder);\n  }\n\n  // Check the max entries separately on access and default entries\n  // HDFS-7582\n  private static void checkMaxEntries(ScopedAclEntries scopedEntries)\n      throws AclException {\n    List<AclEntry> accessEntries = scopedEntries.getAccessEntries();\n    List<AclEntry> defaultEntries = scopedEntries.getDefaultEntries();\n    if (accessEntries.size() > MAX_ENTRIES) {\n      throw new AclException(\"Invalid ACL: ACL has \" + accessEntries.size()\n          + \" access entries, which exceeds maximum of \" + MAX_ENTRIES + \".\");\n    }\n    if (defaultEntries.size() > MAX_ENTRIES) {\n      throw new AclException(\"Invalid ACL: ACL has \" + defaultEntries.size()\n          + \" default entries, which exceeds maximum of \" + MAX_ENTRIES + \".\");\n    }\n  }\n\n  /**\n   * Calculates mask entries required for the ACL.  Mask calculation is performed\n   * separately for each scope: access and default.  This method is responsible\n   * for handling the following cases of mask calculation:\n   * 1. Throws an exception if the caller attempts to remove the mask entry of an\n   *   existing ACL that requires it.  If the ACL has any named entries, then a\n   *   mask entry is required.\n   * 2. If the caller supplied a mask in the ACL spec, use it.\n   * 3. If the caller did not supply a mask, but there are ACL entry changes in\n   *   this scope, then automatically calculate a new mask.  The permissions of","sourceCodeStart":306,"sourceCodeEnd":342,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/AclTransformation.java#L306-L342","documentation":"Error \"Invalid ACL: ACL has {accessEntries.size()} access entries, which exceeds maximum of {MAX_ENTRIES}.\" thrown in apache/hadoop.","triggerScenarios":"setAcl with more than 32 access entries, exceeding the HDFS maximum ACL entries.","commonSituations":"See trigger scenarios.","solutions":["Reduce the number of access ACL entries to at most 32.","Use group-based entries instead of many individual user entries."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}