{"record":{"id":"f42b14670a50d3eb","repo":"apache/hadoop","slug":"permission-denied-user-s-path-s-s-s-s-s","errorCode":null,"errorMessage":"Permission denied: user=%s, path=\"%s\":%s:%s:%s%s","messagePattern":"Permission denied: user=(.+?), path=\"(.+?)\":(.+?):(.+?):(.+?)(.+?)","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java","lineNumber":2874,"sourceCode":"  static void checkAccessPermissions(FileStatus stat, FsAction mode)\n      throws AccessControlException, IOException {\n    FsPermission perm = stat.getPermission();\n    UserGroupInformation ugi = UserGroupInformation.getCurrentUser();\n    String user = ugi.getShortUserName();\n    if (user.equals(stat.getOwner())) {\n      if (perm.getUserAction().implies(mode)) {\n        return;\n      }\n    } else if (ugi.getGroupsSet().contains(stat.getGroup())) {\n      if (perm.getGroupAction().implies(mode)) {\n        return;\n      }\n    } else {\n      if (perm.getOtherAction().implies(mode)) {\n        return;\n      }\n    }\n    throw new AccessControlException(String.format(\n      \"Permission denied: user=%s, path=\\\"%s\\\":%s:%s:%s%s\", user, stat.getPath(),\n      stat.getOwner(), stat.getGroup(), stat.isDirectory() ? \"d\" : \"-\", perm));\n  }\n\n  /**\n   * See {@link FileContext#fixRelativePart}.\n   * @param p the path.\n   * @return relative part.\n   */\n  protected Path fixRelativePart(Path p) {\n    if (p.isUriPathAbsolute()) {\n      return p;\n    } else {\n      return new Path(getWorkingDirectory(), p);\n    }\n  }\n\n  /**","sourceCodeStart":2856,"sourceCodeEnd":2892,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java#L2856-L2892","documentation":"AccessControlException from FileSystem.access(Path, FsAction). The default implementation loads FileStatus, resolves the calling UserGroupInformation, and evaluates POSIX owner/group/other bits in that order; if the applicable class does not imply the requested action it throws this message containing: calling user, path, owner, group, 'd' for directory or '-' for file, and the full permission string. It is the client-side mirror of what the NameNode enforces server-side.","triggerScenarios":"fs.access(p, FsAction.READ|WRITE|EXECUTE) where the mode bits deny the caller's class: caller is not the owner, is not in the file's group (ugi.getGroupsSet() check), and 'other' bits are insufficient; e.g. WRITE against perms 755 for a non-owner, or EXECUTE missing on a parent directory component. Also reached through FileContext and tools that preflight access before I/O.","commonSituations":"Job user lacks +x on a parent directory; data chowned to a different service account; user added to a group but the NameNode's group mapping cache is stale; local integration tests running as a different OS user than the data owner; restrictive umask (027/077) on Hive/Spark scratch dirs.","solutions":["Read the message — it prints user, path, owner:group and the exact permission bits; grant precisely what is missing (hdfs dfs -chmod o+rx <path>, -chown, or -setfacl -m user:<u>:rw- when ACLs are enabled)","If the user should qualify via group: add them on the group source (LDAP/etc.), then hdfs dfsadmin -refreshUserToGroupsMappings or restart long-running services holding the cache","For local/dev runs align the identity with HADOOP_USER_NAME=<owner>","Avoid widening 'other' bits — prefer ACL entries for specific users"],"exampleFix":"# before\n# throws: Permission denied: user=etl, path=\"/data/warehouse/failure_logs\":hive:hadoop:d---------\nhdfs dfs -put failures.log /data/warehouse/failure_logs\n\n# after (grant group write, refresh mappings if group membership changed)\nhdfs dfs -chmod 775 /data/warehouse/failure_logs\nhdfs dfs -setfacl -m user:etl:rwx /data/warehouse/failure_logs\nhdfs dfs -put failures.log /data/warehouse/failure_logs","handlingStrategy":"try-catch","validationCode":"try {\n  fs.access(path, FsAction.WRITE); // same POSIX evaluation, throws ACE with details\n} catch (AccessControlException e) {\n  throw new SecurityException(\"Insufficient rights for \" + path + \": \" + e.getMessage(), e);\n}","typeGuard":null,"tryCatchPattern":"} catch (AccessControlException e) {\n  // e.getMessage() already names user, path, owner:group and perm bits.\n  // Remediate (chmod/chown/setfacl, refresh group mappings, correct user) — do not blind-retry.\n}","preventionTips":["Set service scratch/staging dirs to permissive group bits (e.g., 775) with a sane umask at creation time","After usermod/group changes, run hdfs dfsadmin -refreshUserToGroupsMappings and restart long-lived clients","For local dev, start the JVM with HADOOP_USER_NAME set to the data owner","Preflight with fs.access() and fail with the decoded message before submitting a long job"],"tags":["hadoop","hdfs","filesystem","permissions","posix","accesscontrolexception","authorization"],"backgroundTag":"hdfs-permission-denied","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}