Support Questions

Find answers, ask questions, and share your expertise
Welcome to the upgraded Community! Read this blog to see What’s New!

Should we disable HDFS default ACL to enable Ranger HDFS plugin?


In Sandbox HDP 2.3.2 / Ambar 2.1.2, Ranger is enabled in HDFS out of the box. When I tried to get ACL on CLI, I got the error as follows:

[hdfs@sandbox ~]$ hdfs dfs -getfacl /user/hdfs # file: /user/hdfs # owner: hdfs # group: hdfs getfacl: The ACL operation has been rejected. Support for ACLs has been disabled by setting dfs.namenode.acls.enabled to false.

Is it recommended to disable default ACL? If it is enabled, will we see ACL set command generating Ranger policies?



In a real cluster dfs.namenode.acls.enabled is set to true.

The sandbox is configured for a wide audience to run into the least amount of problems doing the tutorials.

And no, the acl command does not generate Ranger policies.

You set the policies in Ranger and it will manage the ACLs for HDFS as the

dfs.namenode.inode.attributes.provider.class is set to


See Slides 18 and 19 in

If there are no Ranger policies, it falls back to HDFS ACL


but if we set the dfs.namenode.acls.enabled = true and xasecure.add-hadoop-authorization" = true then only hadoop acl will take precedence and ranger policies will be over ridden. @ Ancil McBarnett

Expert Contributor

Also setting "xasecure.add-hadoop-authorization" = false in ranger-hdfs-security.xml in /etc/hadoop/conf will stop the fall back to HDFS ACL.


I think there are some global policies created whenever we enable any Ranger plugin in Sandbox. This global policy by default blocks access to all. So for other policies to work or for it to fallback on the other authorization method, we need to disable this global policy.

Example : Like in this case, need to review if under HDFS Repo in Ranger, any global policy exists? If yes, need to disable it. In this case it will not fallback to HDFS ACLs if this global policy exists.