{"record":{"id":"f89fd1bbe4a9cd57","repo":"apache/hadoop","slug":"setacl-is-only-supported-by-storage-accounts-with","errorCode":null,"errorMessage":"setAcl is only supported by storage accounts with the hierarchical namespace enabled.","messagePattern":"setAcl is only supported by storage accounts with the hierarchical namespace enabled\\.","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java","lineNumber":1389,"sourceCode":"   * Fully replaces ACL of files and directories, discarding all existing\n   * entries.\n   *\n   * @param path    Path to modify\n   * @param aclSpec List of AclEntry describing modifications, must include\n   *                entries for user, group, and others for compatibility with\n   *                permission bits.\n   * @throws IOException if an ACL could not be modified\n   */\n  @Override\n  public void setAcl(final Path path, final List<AclEntry> aclSpec)\n      throws IOException {\n    LOG.debug(\"AzureBlobFileSystem.setAcl path: {}\", path);\n    TracingContext tracingContext = new TracingContext(clientCorrelationId,\n        fileSystemId, FSOperationType.SET_ACL, true, tracingHeaderFormat,\n        listener);\n\n    if (!getIsNamespaceEnabled(tracingContext)) {\n      throw new UnsupportedOperationException(\n          \"setAcl is only supported by storage accounts with the hierarchical \"\n              + \"namespace enabled.\");\n    }\n\n    if (aclSpec == null || aclSpec.size() == 0) {\n      throw new IllegalArgumentException(\"The aclSpec argument is invalid.\");\n    }\n\n    Path qualifiedPath = makeQualified(path);\n\n    try {\n      getAbfsStore().setAcl(qualifiedPath, aclSpec, tracingContext);\n    } catch (AzureBlobFileSystemException ex) {\n      checkException(path, ex);\n    }\n  }\n\n  /**","sourceCodeStart":1371,"sourceCodeEnd":1407,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java#L1371-L1407","documentation":"Thrown by AzureBlobFileSystem.setAcl when the storage account does not have the hierarchical namespace enabled. Fully replacing an ACL is a POSIX-semantics operation available only on HNS accounts; the driver refuses up front on flat accounts. The check happens before the aclSpec validity check, so a non-HNS account fails with this even if the spec is also empty.","triggerScenarios":"Calling fs.setAcl(path, entries) against a non-HNS ABFS account, e.g., setfacl -s style replacement logic.","commonSituations":"ACL migration scripts replaying HDFS ACLs onto Azure; Ranger/Hive plugins syncing ACL policies; accounts created without HNS for cost or compatibility reasons.","solutions":["Enable/use a hierarchical-namespace storage account.","Disable ACL policy sync for mounts backed by flat accounts.","Degrade gracefully by catching UnsupportedOperationException."],"exampleFix":"// before\nfs.setAcl(path, entries);\n\n// after\ntry {\n  fs.setAcl(path, entries);\n} catch (UnsupportedOperationException e) {\n  LOG.warn(\"setAcl unsupported without hierarchical namespace: {}\", path);\n}","handlingStrategy":"try-catch","validationCode":"static boolean isAclCapable(FileSystem fs) {\n  try {\n    fs.getAclStatus(new Path(\"/\"));\n    return true;\n  } catch (UnsupportedOperationException e) {\n    return false;\n  } catch (IOException e) {\n    return true;\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  fs.setAcl(path, entries);\n} catch (UnsupportedOperationException e) {\n  LOG.warn(\"setAcl requires hierarchical namespace: {}\", path);\n}","preventionTips":["Target HNS accounts for ACL replacement workflows.","Disable Ranger/Hive ACL sync for flat mounts.","Cache the HNS probe result per filesystem instance."],"tags":["azure-abfs","acl","hierarchical-namespace","unsupported-operation","setacl"],"backgroundTag":"unsupported-filesystem-operation","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}