[
https://issues.apache.org/jira/browse/IMPALA-9661?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17304645#comment-17304645
]
Quanlong Huang commented on IMPALA-9661:
----------------------------------------
The downside of the above solution is we need to remove privileges required by
the redundant columns as well. So it's not just a rewrite rule.
Here is another solution to resolve the table mask after analyze(). So we know
exactly what columns are needed: [https://gerrit.cloudera.org/c/17199]
> Avoid introducing unused columns in table masking view
> ------------------------------------------------------
>
> Key: IMPALA-9661
> URL: https://issues.apache.org/jira/browse/IMPALA-9661
> Project: IMPALA
> Issue Type: Bug
> Components: Frontend
> Reporter: Quanlong Huang
> Assignee: Quanlong Huang
> Priority: Critical
>
> If a table has column masking policies, we replace its unanalyzed TableRef
> with an analyzed InlineViewRef (table masking view) in FromClause.analyze().
> However, we can't detect which columns are actually used in the original
> query at this point. In fact, analyze() for SelectList, WhereClause,
> GroupByClause and other clauses containing SlotRefs happen after
> FromClause.analyze(). After the whole query block is analyzed, we can get the
> exact set of required columns. We should do table masking there to avoid
> introducing unused columns.
> To be specifit, if table _tbl_(_id_ int, _name_ string, _address_ string) has
> column masking policies for column _name_ and _address_ to mask them, the
> following query
> {code:sql}
> select name from tbl where id > 10;
> {code}
> will be rewritten to
> {code:sql}
> select name from (
> select id, mask(name) as name, mask(address) as address from tbl
> ) tbl where id > 10;
> {code}
> The rewritten query introduce the requirement for SELECT privilege on the
> _address_ column which isn't required by the original query. We should either
> fix this or IMPALA-9223.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscr...@impala.apache.org
For additional commands, e-mail: issues-all-h...@impala.apache.org
