{"record":{"id":"e9281fb46902ade3","repo":"apache/hadoop","slug":"modifyaclentries-is-only-supported-by-storage-acco","errorCode":null,"errorMessage":"modifyAclEntries is only supported by storage accounts with the hierarchical namespace enabled.","messagePattern":"modifyAclEntries is only supported by storage accounts with the hierarchical namespace enabled\\.","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java","lineNumber":1259,"sourceCode":"   * Modifies ACL entries of files and directories.  This method can add new ACL\n   * entries or modify the permissions on existing ACL entries.  All existing\n   * ACL entries that are not specified in this call are retained without\n   * changes.  (Modifications are merged into the current ACL.)\n   *\n   * @param path    Path to modify\n   * @param aclSpec List of AbfsAclEntry describing modifications\n   * @throws IOException if an ACL could not be modified\n   */\n  @Override\n  public void modifyAclEntries(final Path path, final List<AclEntry> aclSpec)\n      throws IOException {\n    LOG.debug(\"AzureBlobFileSystem.modifyAclEntries path: {}\", path);\n    TracingContext tracingContext = new TracingContext(clientCorrelationId,\n        fileSystemId, FSOperationType.MODIFY_ACL, true, tracingHeaderFormat,\n        listener);\n\n    if (!getIsNamespaceEnabled(tracingContext)) {\n      throw new UnsupportedOperationException(\n          \"modifyAclEntries is only supported by storage accounts with the \"\n              + \"hierarchical namespace enabled.\");\n    }\n\n    if (aclSpec == null || aclSpec.isEmpty()) {\n      throw new IllegalArgumentException(\"The value of the aclSpec parameter is invalid.\");\n    }\n\n    Path qualifiedPath = makeQualified(path);\n\n    try {\n      getAbfsStore().modifyAclEntries(qualifiedPath, aclSpec, tracingContext);\n    } catch (AzureBlobFileSystemException ex) {\n      checkException(path, ex);\n    }\n  }\n\n  /**","sourceCodeStart":1241,"sourceCodeEnd":1277,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java#L1241-L1277","documentation":"Thrown by AzureBlobFileSystem.modifyAclEntries when the storage account does not have the hierarchical namespace (HNS) enabled. ACL modification is a POSIX-semantics feature only available on HNS accounts; flat-namespace blob accounts cannot honor it, so the driver refuses up front instead of failing at the service. The namespace state is resolved (and cached) by getIsNamespaceEnabled, which probes the service if unknown.","triggerScenarios":"Calling fs.modifyAclEntries(path, entries) against an ABFS endpoint whose account was created without hierarchical namespace (flat namespace).","commonSituations":"Account provisioned without HNS; pointing jobs at a legacy blob account via abfs://; Hive/Spark/Ranger plugins that propagate ACLs unconditionally; test suites run against non-HNS emulators or accounts.","solutions":["Use a storage account with hierarchical namespace enabled (required for ACL APIs).","Gate ACL propagation in the calling framework (disable ACL sync features on flat accounts).","Feature-detect by catching UnsupportedOperationException and degrade gracefully."],"exampleFix":"// before\nfs.modifyAclEntries(path, entries);\n\n// after\ntry {\n  fs.modifyAclEntries(path, entries);\n} catch (UnsupportedOperationException e) {\n  LOG.warn(\"ACL APIs unavailable; account lacks hierarchical namespace: {}\", path);\n}","handlingStrategy":"try-catch","validationCode":"static boolean isAclCapable(FileSystem fs) {\n  try {\n    fs.getAclStatus(new Path(\"/\"));\n    return true;\n  } catch (UnsupportedOperationException e) {\n    return false;\n  } catch (IOException e) {\n    return true; // service reachable and HNS probe passed the client check\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  fs.modifyAclEntries(path, entries);\n} catch (UnsupportedOperationException e) {\n  LOG.warn(\"ACL APIs need hierarchical namespace; skipping: {}\", path);\n}","preventionTips":["Provision HNS-enabled accounts for any workflow using ACLs.","Cache the capability probe per filesystem URI, not per call.","Make ACL propagation in tools configurable so flat accounts can opt out."],"tags":["azure-abfs","acl","hierarchical-namespace","unsupported-operation"],"backgroundTag":"unsupported-filesystem-operation","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}