static Pair<Set<String>, Set<TableName>> getUserNamespaceAndTable(Table aclTable,
      String userName) throws IOException {
      Set<String> namespaces = new HashSet<>();
      Set<TableName> tables = new HashSet<>();
      List<byte[]> userEntries = getUserEntries(aclTable, userName);
      for (byte[] entry : userEntries) {
        if (PermissionStorage.isNamespaceEntry(entry)) {
          namespaces.add(Bytes.toString(PermissionStorage.fromNamespaceEntry(entry)));
        } else if (PermissionStorage.isTableEntry(entry)) {
          tables.add(TableName.valueOf(entry));
        }
      }
      return new Pair<>(namespaces, tables);
    }
Add a new CF in HBase acl table to record if the HBase read permission is synchronized to
related hfiles. The record has two usages: 1. check if we need to remove HDFS acls for a
grant without READ permission(eg: grant user table read permission and then grant user table
write permission without merging the existing permissions, in this case, need to remove HDFS
acls); 2. skip some HDFS acl sync because it may be already set(eg: grant user table read
permission and then grant user ns read permission; grant user table read permission and then
grant user table write permission with merging the existing permissions).
hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/SnapshotScannerHDFSAclController.java