{"record":{"id":"fd20018a2962559a","repo":"juicedata/juicefs","slug":"permission-denied-user-user-access-a","errorCode":null,"errorMessage":"Permission denied: user=\" + user + \", access=\" + action + \", path=\\\"\" + path + \"\\\"","messagePattern":"Permission denied: user=\" \\+ user \\+ \", access=\" \\+ action \\+ \", path=\\\\\"\" \\+ path \\+ \"\\\\\"","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"warning","filePath":"sdk/java/src/main/java/io/juicefs/permission/RangerPermissionChecker.java","lineNumber":165,"sourceCode":"      if (checkResult(authzStatus, user, parentAccess.toString(), toPathString(obj.parent.getPath()))) {\n        return fallback;\n      }\n    }\n\n    if (authzStatus == AuthzStatus.ALLOW && access != null && obj.current != null) {\n      authzStatus = isAccessAllowed(obj.current, access, context);\n      if (checkResult(authzStatus, user, access.toString(), toPathString(obj.current.getPath()))) {\n        return fallback;\n      }\n    }\n\n    if (checkOwner) {\n      String owner = null;\n      if (obj.current != null) {\n        owner = obj.current.getOwner();\n      }\n      if (!user.equals(owner)) {\n        throw new AccessControlException(\n            assembleExceptionMessage(user, getFirstNonNullAccess(ancestorAccess, parentAccess, access),\n                toPathString(obj.current.getPath())));\n      }\n    }\n    // check access by ranger success\n    return !fallback;\n  }\n\n  public void cleanUp() {\n    try {\n      rangerPlugin.cleanup();\n    } catch (Exception e) {\n      LOG.warn(\"Error when clean up ranger plugin threads.\", e);\n    }\n    try {\n      superGroupFileSystem.close();\n    } catch (Exception e) {\n      LOG.warn(\"Error when close super group file system.\", e);","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/sdk/java/src/main/java/io/juicefs/permission/RangerPermissionChecker.java#L147-L183","documentation":"RangerPermissionChecker.checkPermission throws AccessControlException when the path's owner does not match the requesting user and owner-only access (checkOwner) is required. The message is built by assembleExceptionMessage with user, action and path.","triggerScenarios":"An ACL/ranger authorization path requiring owner check (e.g. sticky-bit or owner-scoped entry) where obj.current.getOwner() != user and no ancestor/parent access satisfies the requirement.","commonSituations":"User operating on files owned by another account without sufficient ranger policy; running jobs as a different user than file owner; missing ranger policies granting the user the needed access.","solutions":["Grant the user the required access via a Ranger policy","Change file ownership (chown) if appropriate","Access the path as the owning user","Verify the path resolution picks the intended obj.current inode"],"exampleFix":"// before\nhadoop fs -ls /jfs/vol/other-user-dir  # as user 'alice'\n// after (as owner or with granted policy)\nsudo -u owner hadoop fs -ls /jfs/vol/other-user-dir","handlingStrategy":"try-catch","validationCode":"FileStatus st = fs.getFileStatus(path);\nString owner = st.getOwner();\nboolean ownerRestricted = !currentUser.equals(owner); // requires owner-access path","typeGuard":"boolean isOwner(FileStatus st, String user) { return user.equals(st.getOwner()); }","tryCatchPattern":"try {\n  checker.checkPermission(user, action, path);\n} catch (AccessControlException e) {\n  LOG.warn(\"Access denied for \" + user + \" on \" + path + \": \" + e.getMessage());\n  // surface a permission error to caller or fall back\n}","preventionTips":["Grant users access via Ranger policies rather than relying on ownership","Check file ownership before performing owner-scoped operations","Keep user/group sync (usersync) aligned with file owners"],"tags":["permission","ranger","acl","hadoop"],"backgroundTag":"permission-denied","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}