HADOOP-10270. getfacl does not display effective permissions of masked. Contributed by Chris Nauroth.