static List<byte[]> getUserEntries(Table aclTable, String userName) throws IOException {
      Scan scan = new Scan();
      scan.addColumn(HDFS_ACL_FAMILY, Bytes.toBytes(userName));
      ResultScanner scanner = aclTable.getScanner(scan);
      List<byte[]> entry = new ArrayList<>();
      for (Result result : scanner) {
        if (result != null && result.getRow() != null) {
          entry.add(result.getRow());
        }
      }
      return entry;
    }
Add a new CF in HBase acl table to record if the HBase read permission is synchronized to
related hfiles. The record has two usages: 1. check if we need to remove HDFS acls for a
grant without READ permission(eg: grant user table read permission and then grant user table
write permission without merging the existing permissions, in this case, need to remove HDFS
acls); 2. skip some HDFS acl sync because it may be already set(eg: grant user table read
permission and then grant user ns read permission; grant user table read permission and then
grant user table write permission with merging the existing permissions).
hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/SnapshotScannerHDFSAclController.java