{"record":{"id":"f19df6ffba7400d2","repo":"apache/hadoop","slug":"acls-are-not-supported-on-symlinks","errorCode":null,"errorMessage":"ACLs are not supported on symlinks","messagePattern":"ACLs are not supported on symlinks","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/INodeSymlink.java","lineNumber":119,"sourceCode":"    return summary;\n  }\n\n  @Override\n  public void dumpTreeRecursively(PrintWriter out, StringBuilder prefix,\n      final int snapshot) {\n    super.dumpTreeRecursively(out, prefix, snapshot);\n    out.print(\" ~> \");\n    out.println(getSymlinkString());\n  }\n\n  @Override\n  public void accept(NamespaceVisitor visitor, int snapshot) {\n    visitor.visitSymlink(this, snapshot);\n  }\n\n  @Override\n  public void removeAclFeature() {\n    throw new UnsupportedOperationException(\"ACLs are not supported on symlinks\");\n  }\n\n  @Override\n  public void addAclFeature(AclFeature f) {\n    throw new UnsupportedOperationException(\"ACLs are not supported on symlinks\");\n  }\n\n  @Override\n  final XAttrFeature getXAttrFeature(int snapshotId) {\n    throw new UnsupportedOperationException(\"XAttrs are not supported on symlinks\");\n  }\n  \n  @Override\n  public void removeXAttrFeature() {\n    throw new UnsupportedOperationException(\"XAttrs are not supported on symlinks\");\n  }\n  \n  @Override","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/INodeSymlink.java#L101-L137","documentation":"INodeSymlink.removeAclFeature unconditionally throws UnsupportedOperationException(\"ACLs are not supported on symlinks\"). HDFS attaches ACL features only to files and directories; any ACL-removal code path whose INode is a symlink terminates here. It is by design, not corruption — HDFS simply has no ACL representation for symlink inodes.","triggerScenarios":"removeAcl on a path that is a symlink (DFS API, WebHDFS setAcl/removeAcl); recursive ACL-stripping tools that do not skip symlinks; internal code calling removeAclFeature directly on an INode recovered from the namespace.","commonSituations":"Bulk ACL migration/normalization scripts walking trees that contain symlinks; compliance tooling that applies uniform ACLs across a subtree; distcp preserving ACLs onto trees with links.","solutions":["Skip symlinks when removing ACLs — filter with FileStatus.isSymlink() during traversal","If the intent is to manage ACLs of the destination, resolve the link target and operate on that path","Wrap per-entry operations so one symlink does not abort the whole batch"],"exampleFix":"# before\nfor p in $(hdfs dfs -ls -R /data | awk '{print $NF}'); do\n  hdfs dfs -setfacl -b \"$p\"   # fails on symlinks\n# -> UnsupportedOperationException: ACLs are not supported on symlinks\n\n# after\nfor p in $(hdfs dfs -ls -R /data | grep -v '^l' | awk '{print $NF}'); do\n  hdfs dfs -setfacl -b \"$p\" || echo \"skipped $p\"\ndone","handlingStrategy":"type-guard","validationCode":"// Before removeAcl over a tree, filter links\nFileStatus st = fs.getFileStatus(p);\nif (st.isSymlink()) { continue; }\nfs.removeAcl(p);","typeGuard":"boolean canHaveAcl(FileSystem fs, Path p) throws IOException {\n  FileStatus st = fs.getFileStatus(p);\n  return !st.isSymlink();   // files and directories support ACLs\n}","tryCatchPattern":"catch (UnsupportedOperationException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"symlinks\")) {\n    skipAndRecord(path);    // HDFS design limit: skip links, keep processing\n  } else {\n    throw e;\n  }\n}","preventionTips":["Filter isSymlink() in every recursive ACL script/tool","Operate on the resolved target when the destination is what matters","Per-path error isolation in batch tools so a single link cannot abort a rollout"],"tags":["hdfs","acl","symlink","unsupported-operation","namenode"],"backgroundTag":"operation-not-supported-on-file-type","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}