static void deleteUserTableHdfsAcl(Connection connection, Set<String> users,
      TableName tableName) throws IOException {
      try (Table aclTable = connection.getTable(PermissionStorage.ACL_TABLE_NAME)) {
        for (String user : users) {
          deleteUserTableHdfsAcl(aclTable, user, tableName);
        }
      }
    }
Add a new CF in HBase acl table to record if the HBase read permission is synchronized to
related hfiles. The record has two usages: 1. check if we need to remove HDFS acls for a
grant without READ permission(eg: grant user table read permission and then grant user table
write permission without merging the existing permissions, in this case, need to remove HDFS
acls); 2. skip some HDFS acl sync because it may be already set(eg: grant user table read
permission and then grant user ns read permission; grant user table read permission and then
grant user table write permission with merging the existing permissions).
hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/SnapshotScannerHDFSAclController.java