diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt
index 9f70a24f9b8..689cb45d815 100644
--- a/hadoop-common-project/hadoop-common/CHANGES.txt
+++ b/hadoop-common-project/hadoop-common/CHANGES.txt
@@ -616,6 +616,9 @@ Release 2.6.0 - UNRELEASED
 
     HADOOP-11216. Improve Openssl library finding. (cmccabe via yliu)
 
+    HADOOP-11254. Changed visibility of AccessControlList to be public for
+    consumption by ecosystem. (Zhijie Shen via vinodkv)
+
   OPTIMIZATIONS
 
     HADOOP-10838. Byte array native checksumming. (James Thomas via todd)
diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java
index d250df10b2e..f19776fc139 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java
@@ -39,7 +39,7 @@ import org.apache.hadoop.util.StringUtils;
 /**
  * Class representing a configured access control list.
  */
-@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"})
+@InterfaceAudience.Public
 @InterfaceStability.Evolving
 public class AccessControlList implements Writable {
 
@@ -209,7 +209,7 @@ public class AccessControlList implements Writable {
    * Get the names of users allowed for this service.
    * @return the set of user names. the set must not be modified.
    */
-  Collection<String> getUsers() {
+  public Collection<String> getUsers() {
     return users;
   }
   
@@ -217,7 +217,7 @@ public class AccessControlList implements Writable {
    * Get the names of user groups allowed for this service.
    * @return the set of group names. the set must not be modified.
    */
-  Collection<String> getGroups() {
+  public Collection<String> getGroups() {
     return groups;
   }