[jira] [Created] (IMPALA-11870) row__id of ACID tables don't work with Ranger column/row masking policies

["Quanlong Huang (Jira)" <ji...@apache.org>]

Quanlong Huang created IMPALA-11870:
---------------------------------------

             Summary: row__id of ACID tables don't work with Ranger column/row masking policies
                 Key: IMPALA-11870
                 URL: https://issues.apache.org/jira/browse/IMPALA-11870
             Project: IMPALA
          Issue Type: Bug
          Components: Frontend, Security
            Reporter: Quanlong Huang


"{{{}row__id{}}}" is a synthetic column that only exists in full ACID tables. If there are Ranger column-masking/row-filtering policies applied on the table, it can't be resolved in many cases.

For instance, creating a column-masking policy on table functional_orc_def.alltypestiny that mask column "id" to "id * 100". The following queries would fail:
{code:sql}
select id, row__id.* from functional_orc_def.alltypestiny;
ERROR: AnalysisException: Could not resolve star expression: 'row__id.*'

select id, row__id.rowid from functional_orc_def.alltypestiny;
ERROR: AnalysisException: Could not resolve column/field reference: 'row__id.rowid'{code}
Note that it still works in some cases, e.g.
{code:sql}
select row__id.* from functional_orc_def.alltypestiny;
+-----------+---------------------+-----------+-------+--------------------+
| operation | originaltransaction | bucket    | rowid | currenttransaction |
+-----------+---------------------+-----------+-------+--------------------+
| 0         | 5                   | 536870912 | 0     | 5                  |
| 0         | 5                   | 536870912 | 1     | 5                  |
| 0         | 5                   | 536870912 | 0     | 5                  |
| 0         | 5                   | 536870912 | 1     | 5                  |
| 0         | 5                   | 536870912 | 0     | 5                  |
| 0         | 5                   | 536870912 | 1     | 5                  |
| 0         | 5                   | 536870912 | 0     | 5                  |
| 0         | 5                   | 536870912 | 1     | 5                  |
+-----------+---------------------+-----------+-------+--------------------+
{code}
The failed cases are all using the "row__id" column with normal columns together.

CC [~boroknagyz], [~fangyurao] 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org