anchor.diff:   * {hbase-rootdir}/archive/data/{namespace}/{table}
    * {hbase-rootdir}/.hbase-snapshot/{snapshotName}
   
  -So the basic idea is to add or remove HDFS ACLs to files of global/namespace/table directory when grant or revoke permission to global/namespace/table.
  +So the basic idea is to add or remove HDFS ACLs to files of
  +global/namespace/table directory when grant or revoke permission to global/namespace/table.
   
   See the design doc in link:https://issues.apache.org/jira/browse/HBASE-18659[HBASE-18659] for more details.
   
  
positive.code: :toc: left
  :source-language: java
  
  In HBase, scan a table costs many CPU, memory... resources. Luckily, HBase provides a TableSnapshotScanner and TableSnapshotInputFormat (introduced by link:https://issues.apache.org/jira/browse/HBASE-8369[HBASE-8369]), which performs a scan over snapshot files.
  By this way, we can bypasse HBase servers, and access the underlying files directly to provide maximum performance. And can also be used with offline HBase with in-place or exported snapshot files.
  
  To read from snapshot files directly from the file system, the user must have sufficient permissions to access snapshot and reference data files.
  
  === TableSnapshotScanner
  
  TableSnapshotScanner provide a way to do single client side scan over snapshot files.
  When use TableSnapshotScanner, we must specify a temporary directory to copy the snapshot files into. Current user should have write permissions to this directory, and this should not be a subdirectory of rootdir. The scanner deletes the contents of the directory once the scanner is closed.
  
  .Use TableSnapshotScanner
  ====
  [source,java]
  ----
  Path restoreDir = new Path("XX"); // restore dir should not be a subdirectory HBase rootdir
  Scan scan = new Scan();
  try (TableSnapshotScanner scanner = new TableSnapshotScanner(conf, restoreDir, snapshotName, scan)) {
      Result result = scanner.next();
  
negative.code: ====
  
  === Permission to access snapshot and data files
  Generally, only the HBase owner or the HDFS admin have the permission to access HFiles.
  
  link:https://issues.apache.org/jira/browse/HBASE-18659[HBASE-18659] use HDFS ACLs to make HBase granted user have the permission to access the snapshot files.
  
  ==== link:https://hadoop.apache.org/docs/r2.7.1/hadoop-project-dist/hadoop-hdfs/HdfsPermissionsGuide.html#ACLs_Access_Control_Lists[HDFS ACLs]
  
  HDFS ACLs supports an "access ACL", which defines the rules to enforce during permission checks, and a "default ACL",
  which defines the ACL entries that new child files or sub-directories receive automatically during creation.
  By HDFS ACLs, HBase sync granted users with read permission to HFiles.
  
  ==== Basic idea
  
  