[ https://issues.apache.org/jira/browse/IMPALA-9661?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17304645#comment-17304645 ]
Quanlong Huang commented on IMPALA-9661: ---------------------------------------- The downside of the above solution is we need to remove privileges required by the redundant columns as well. So it's not just a rewrite rule. Here is another solution to resolve the table mask after analyze(). So we know exactly what columns are needed: [https://gerrit.cloudera.org/c/17199] > Avoid introducing unused columns in table masking view > ------------------------------------------------------ > > Key: IMPALA-9661 > URL: https://issues.apache.org/jira/browse/IMPALA-9661 > Project: IMPALA > Issue Type: Bug > Components: Frontend > Reporter: Quanlong Huang > Assignee: Quanlong Huang > Priority: Critical > > If a table has column masking policies, we replace its unanalyzed TableRef > with an analyzed InlineViewRef (table masking view) in FromClause.analyze(). > However, we can't detect which columns are actually used in the original > query at this point. In fact, analyze() for SelectList, WhereClause, > GroupByClause and other clauses containing SlotRefs happen after > FromClause.analyze(). After the whole query block is analyzed, we can get the > exact set of required columns. We should do table masking there to avoid > introducing unused columns. > To be specifit, if table _tbl_(_id_ int, _name_ string, _address_ string) has > column masking policies for column _name_ and _address_ to mask them, the > following query > {code:sql} > select name from tbl where id > 10; > {code} > will be rewritten to > {code:sql} > select name from ( > select id, mask(name) as name, mask(address) as address from tbl > ) tbl where id > 10; > {code} > The rewritten query introduce the requirement for SELECT privilege on the > _address_ column which isn't required by the original query. We should either > fix this or IMPALA-9223. -- This message was sent by Atlassian Jira (v8.3.4#803005) --------------------------------------------------------------------- To unsubscribe, e-mail: issues-all-unsubscr...@impala.apache.org For additional commands, e-mail: issues-all-h...@impala.apache.org