juicedata/juicefs · error · AclException

Invalid default ACL: the user, group and other entries are r

Error message

Invalid default ACL: the user, group and other entries are required.

What it means

The same invariant check as the access-ACL case, applied to the DEFAULT scope: if a default ACL exists at all (getDefaultEntries() is non-empty), it must contain DEFAULT user, group and other entries. This is only raised when a default ACL is present but incomplete, so it catches partially specified default ACLs.

Source

Thrown at sdk/java/src/main/java/io/juicefs/utils/AclTransformation.java:190

        throw new AclException("Invalid ACL: this entry type must not have a name: " + entry + ".");
      }
      prevEntry = entry;
    }

    ScopedAclEntries scopedEntries = new ScopedAclEntries(aclBuilder);
    checkMaxEntries(scopedEntries);

    // Search for the required base access entries.  If there is a default ACL,
    // then do the same check on the default entries.
    for (AclEntryType type : EnumSet.of(USER, GROUP, OTHER)) {
      AclEntry accessEntryKey = new AclEntry.Builder().setScope(ACCESS).setType(type).build();
      if (Collections.binarySearch(scopedEntries.getAccessEntries(), accessEntryKey, ACL_ENTRY_COMPARATOR) < 0) {
        throw new AclException("Invalid ACL: the user, group and other entries are required.");
      }
      if (!scopedEntries.getDefaultEntries().isEmpty()) {
        AclEntry defaultEntryKey = new AclEntry.Builder().setScope(DEFAULT).setType(type).build();
        if (Collections.binarySearch(scopedEntries.getDefaultEntries(), defaultEntryKey, ACL_ENTRY_COMPARATOR) < 0) {
          throw new AclException("Invalid default ACL: the user, group and other entries are required.");
        }
      }
    }
    return Collections.unmodifiableList(aclBuilder);
  }

  private static void checkMaxEntries(ScopedAclEntries scopedEntries) throws AclException {
    List<AclEntry> accessEntries = scopedEntries.getAccessEntries();
    List<AclEntry> defaultEntries = scopedEntries.getDefaultEntries();
    if (accessEntries.size() > MAX_ENTRIES) {
      throw new AclException("Invalid ACL: ACL has " + accessEntries.size() + " access entries, which exceeds maximum of " + MAX_ENTRIES + ".");
    }
    if (defaultEntries.size() > MAX_ENTRIES) {
      throw new AclException("Invalid ACL: ACL has " + defaultEntries.size() + " default entries, which exceeds maximum of " + MAX_ENTRIES + ".");
    }
  }

  private static void calculateMasks(List<AclEntry> aclBuilder, EnumMap<AclEntryScope, AclEntry> providedMask, EnumSet<AclEntryScope> maskDirty, EnumSet<AclEntryScope> scopeDirty) throws AclException {

View on GitHub (pinned to c9a67b23e8)

Solutions

  1. Include the full set of base default entries (default:user::, default:group::, default:other::) whenever any default entry is present.
  2. If only an access ACL was intended, remove all default: entries from the spec instead of leaving a partial default ACL.
  3. Compute the base default permissions from the existing access ACL and add them to the spec.

Example fix

// before
mergeAclEntries(path, "default:user:alice:rwx");
// after
mergeAclEntries(path, "default:user::rwx,default:user:alice:rwx,default:group::r-x,default:other::r--");
Defensive patterns

Strategy: validation

Validate before calling

def default_acl_complete(entries):
    d = [e for e in entries if e.getScope() == AclEntryScope.DEFAULT]
    if not d:
        return True
    types = {e.getType() for e in d}
    return {AclEntryType.USER, AclEntryType.GROUP, AclEntryType.OTHER} <= types

Try / catch

try {
  mergeAclEntries(path, spec);
} catch (AclException e) {
  if (e.getMessage().contains("Invalid default ACL")) {
    spec = addBaseDefaultEntries(spec);
    mergeAclEntries(path, spec);
  } else throw e;
}

Prevention

When it happens

Trigger: Calling mergeAclEntries/replaceAclEntries with a default ACL (e.g. 'default:user:alice:rwx' or 'default:group::r-x' alone) that lacks the required default:user::, default:group:: and default:other:: trio.

Common situations: Setting a default ACL for inheritance on a directory by adding only named default entries; copying a default ACL from another tool that omitted base entries; hand-editing an ACL dump and dropping default:other::.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/8b6377f27163ee2e. Report an issue: GitHub.