{"record":{"id":"f0b681cb6daf8d29","repo":"prestodb/presto","slug":"permission-denied-f0b681","errorCode":"PERMISSION_DENIED","errorMessage":"PERMISSION_DENIED (message from AccessControlException)","messagePattern":"PERMISSION_DENIED \\(message from AccessControlException\\)","errorType":"error_code","errorClass":"PrestoException","httpStatus":null,"severity":"error","filePath":"presto-hive/src/main/java/com/facebook/presto/hive/util/HiveFileIterator.java","lineNumber":161,"sourceCode":"        @Override\n        public HiveFileInfo next()\n        {\n            try {\n                return fileStatusIterator.next();\n            }\n            catch (IOException e) {\n                throw processException(e);\n            }\n        }\n\n        private PrestoException processException(IOException exception)\n        {\n            namenodeStats.getRemoteIteratorNext().recordException(exception);\n            if (exception instanceof FileNotFoundException) {\n                return new PrestoException(HIVE_FILE_NOT_FOUND, \"Partition location does not exist: \" + path, exception);\n            }\n            if (exception instanceof AccessControlException) {\n                throw new PrestoException(PERMISSION_DENIED, exception.getMessage(), exception);\n            }\n            return new PrestoException(HIVE_FILESYSTEM_ERROR, format(\"Failed to list directory: %s. %s\", path, exception.getMessage()), exception);\n        }\n    }\n\n    public static class NestedDirectoryNotAllowedException\n            extends RuntimeException\n    {\n        public NestedDirectoryNotAllowedException()\n        {\n            super(\"Nested sub-directories are not allowed\");\n        }\n    }\n\n    public interface ListDirectoryOperation\n    {\n        RemoteIterator<HiveFileInfo> list(Path path)\n                throws IOException;","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive/src/main/java/com/facebook/presto/hive/util/HiveFileIterator.java#L143-L179","documentation":"HiveFileIterator.processException maps filesystem exceptions during directory listing to Presto exceptions. When the underlying FileSystem throws an AccessControlException (HDFS permission check failed), the iterator rethrows it as PrestoException with code PERMISSION_DENIED, preserving the HDFS message. It means the Presto user lacks read/execute permission on the partition path.","triggerScenarios":"hasNext()/next() on HiveFileIterator triggers LocatedFileStatus listing; the Hadoop FileSystem raises AccessControlException because the connecting user lacks r/x on the directory or file.","commonSituations":"Files owned by another user/group with restrictive ACLs after a re-write job; Presto service user not in the HDFS group; permission/ACL changes on the table location; Kerberos/HDFS permission enforcement with wrong proxy user.","solutions":["Grant the Presto service user read/execute on the partition path (hdfs dfs -chmod / -setfacl)","chown/chgrp the data files to a group the Presto user belongs to","Verify Kerberos/proxy-user configuration so queries run as the expected user (hive.server2.proxy.user, HDFS impersonation)","Check HDFS audit logs for the exact path and permission denied","Confirm the table LOCATION points to the intended directory (not someone else's)"],"exampleFix":"// before\n-rw-------  etl_user  data.orc   (presto user denied)\n// after\nsudo -u hdfs hdfs dfs -chmod 640 /data/table/part=2026-01-01/data.orc\nsudo -u hdfs hdfs dfs -chgrp presto_users /data/table/part=2026-01-01/data.orc","handlingStrategy":"try-catch","validationCode":"// check access before listing\ntry {\n    fileSystem.access(partitionPath, FsAction.READ_EXECUTE);\n} catch (AccessControlException e) {\n    throw new PrestoException(PERMISSION_DENIED, \"No access to \" + partitionPath, e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    listPartitionFiles(path);\n} catch (PrestoException e) {\n    if (PERMISSION_DENIED.toErrorCode().equals(e.getErrorCode())) {\n        LOG.error(\"Grant the Presto user r/x on \" + path + \": \" + e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Keep data group-readable by the group the Presto user belongs to","Automate chmod/chgrp (or Ranger/Sentry ACLs) after every write job","Verify impersonation/Kerberos settings so queries use the intended user","Check HDFS audit logs when permission errors appear after schema/location changes"],"tags":["hive","permissions","hdfs","access-control","security"],"backgroundTag":"permission-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}