public void setCommonDirectoryPermission() throws IOException {
    // Set public directory permission to 751 to make all users have access permission.
    // And we also need the access permission of the parent of HBase root directory, but
    // it's not set here, because the owner of HBase root directory may don't own permission
    // to change it's parent permission to 751.
    // The {root/.tmp} and {root/.tmp/data} directories are created to make global user HDFS
    // ACLs can be inherited.
    List<Path> paths = Lists.newArrayList(pathHelper.getRootDir(), pathHelper.getMobDir(),
      pathHelper.getTmpDir(), pathHelper.getArchiveDir());
    paths.addAll(getGlobalRootPaths());
    for (Path path : paths) {
      createDirIfNotExist(path);
      fs.setPermission(path, new FsPermission(
        conf.get(COMMON_DIRECTORY_PERMISSION, COMMON_DIRECTORY_PERMISSION_DEFAULT)));
    }
    // create snapshot restore directory
    Path restoreDir =
      new Path(conf.get(SNAPSHOT_RESTORE_TMP_DIR, SNAPSHOT_RESTORE_TMP_DIR_DEFAULT));
    createDirIfNotExist(restoreDir);
    fs.setPermission(restoreDir, new FsPermission(conf.get(SNAPSHOT_RESTORE_DIRECTORY_PERMISSION,
      SNAPSHOT_RESTORE_DIRECTORY_PERMISSION_DEFAULT)));
  }
A helper to modify or remove HBase granted user default and access HDFS ACLs over hFiles.
hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/SnapshotScannerHDFSAclHelper.java