prestodb/presto · error · PrestoException

PERMISSION_DENIED

PERMISSION_DENIED

Error message

PERMISSION_DENIED (message from AccessControlException)

What it means

HiveFileIterator.processException maps filesystem exceptions during directory listing to Presto exceptions. When the underlying FileSystem throws an AccessControlException (HDFS permission check failed), the iterator rethrows it as PrestoException with code PERMISSION_DENIED, preserving the HDFS message. It means the Presto user lacks read/execute permission on the partition path.

Source

Thrown at presto-hive/src/main/java/com/facebook/presto/hive/util/HiveFileIterator.java:161

        @Override
        public HiveFileInfo next()
        {
            try {
                return fileStatusIterator.next();
            }
            catch (IOException e) {
                throw processException(e);
            }
        }

        private PrestoException processException(IOException exception)
        {
            namenodeStats.getRemoteIteratorNext().recordException(exception);
            if (exception instanceof FileNotFoundException) {
                return new PrestoException(HIVE_FILE_NOT_FOUND, "Partition location does not exist: " + path, exception);
            }
            if (exception instanceof AccessControlException) {
                throw new PrestoException(PERMISSION_DENIED, exception.getMessage(), exception);
            }
            return new PrestoException(HIVE_FILESYSTEM_ERROR, format("Failed to list directory: %s. %s", path, exception.getMessage()), exception);
        }
    }

    public static class NestedDirectoryNotAllowedException
            extends RuntimeException
    {
        public NestedDirectoryNotAllowedException()
        {
            super("Nested sub-directories are not allowed");
        }
    }

    public interface ListDirectoryOperation
    {
        RemoteIterator<HiveFileInfo> list(Path path)
                throws IOException;

View on GitHub (pinned to 55bb57d202)

Solutions

Grant the Presto service user read/execute on the partition path (hdfs dfs -chmod / -setfacl)
chown/chgrp the data files to a group the Presto user belongs to
Verify Kerberos/proxy-user configuration so queries run as the expected user (hive.server2.proxy.user, HDFS impersonation)
Check HDFS audit logs for the exact path and permission denied
Confirm the table LOCATION points to the intended directory (not someone else's)

Example fix

// before
-rw-------  etl_user  data.orc   (presto user denied)
// after
sudo -u hdfs hdfs dfs -chmod 640 /data/table/part=2026-01-01/data.orc
sudo -u hdfs hdfs dfs -chgrp presto_users /data/table/part=2026-01-01/data.orc

Defensive patterns

Strategy: try-catch

Validate before calling

// check access before listing
try {
    fileSystem.access(partitionPath, FsAction.READ_EXECUTE);
} catch (AccessControlException e) {
    throw new PrestoException(PERMISSION_DENIED, "No access to " + partitionPath, e);
}

Try / catch

try {
    listPartitionFiles(path);
} catch (PrestoException e) {
    if (PERMISSION_DENIED.toErrorCode().equals(e.getErrorCode())) {
        LOG.error("Grant the Presto user r/x on " + path + ": " + e.getMessage());
    }
    throw e;
}

Prevention

Keep data group-readable by the group the Presto user belongs to
Automate chmod/chgrp (or Ranger/Sentry ACLs) after every write job
Verify impersonation/Kerberos settings so queries use the intended user
Check HDFS audit logs when permission errors appear after schema/location changes

When it happens

Trigger: hasNext()/next() on HiveFileIterator triggers LocatedFileStatus listing; the Hadoop FileSystem raises AccessControlException because the connecting user lacks r/x on the directory or file.

Common situations: Files owned by another user/group with restrictive ACLs after a re-write job; Presto service user not in the HDFS group; permission/ACL changes on the table location; Kerberos/HDFS permission enforcement with wrong proxy user.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/f0b681cb6daf8d29. Report an issue: GitHub.