[
https://issues.apache.org/jira/browse/IMPALA-8363?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16819462#comment-16819462
]
ASF subversion and git services commented on IMPALA-8363:
---------------------------------------------------------
Commit 986dbbc5145a4cfd796453d94e6c74eb786ea0d7 in impala's branch
refs/heads/master from Fredy Wijaya
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=986dbbc ]
IMPALA-8363: Deny access when column masking or row filtering is enabled in
Ranger
This patch updates the Ranger authorization checker code to deny access
when column masking and row filtering is enabled in Ranger for queries
that that have columns/tables specified in column mask and row filter
policies. This is to prevent data leak, such that the data that is
masked/filtered in Hive should not be visible at all in Impala until
Impala has full support for column masking and row filtering.
Testing:
- Added tests in AuthorizationStmtTest to test queries with column
masking and row filtering enabled.
- Ran all FE tests
- Ran all E2E tests
Change-Id: If46b4bf24d916e4a4ea8a36ff4acfd95d5f45c8e
Reviewed-on: http://gerrit.cloudera.org:8080/12927
Reviewed-by: Fredy Wijaya <fwij...@cloudera.com>
Tested-by: Impala Public Jenkins <impala-public-jenk...@cloudera.com>
> Disable column masking and row filtering
> ----------------------------------------
>
> Key: IMPALA-8363
> URL: https://issues.apache.org/jira/browse/IMPALA-8363
> Project: IMPALA
> Issue Type: Sub-task
> Components: Frontend
> Reporter: Fredy Wijaya
> Assignee: Fredy Wijaya
> Priority: Critical
> Fix For: Impala 3.3.0
>
>
> Because of policy sharing between Hive and Ranger, Impala needs throw an
> authorization exception when column masking and row filtering is enabled in
> Hive. This is only temporary until Impala has proper support for column
> masking and row filtering.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscr...@impala.apache.org
For additional commands, e-mail: issues-all-h...@impala.apache.org
