The ideal way of doing partial results is something like Optional, though that's Java 8 and still won't work perfectly since if we fail to list, we won't know the number of homedirs/EZs. It's something we could consider for trunk, if we really care about it.
IMO the current idea is good. The most likely cause of IOExceptions is if something throws an AccessControlException if it's not being run as a superuser, and the logging should help with that.
One little nit though is that we aren't printing the exception in these logs, which would help with debugging:
LOG.warn("Cannot get all trash roots.");
DFSClient.LOG.warn("Cannot get all encrypted trash roots.");
Otherwise I'm +1, thanks Zhe.