Uploaded image for project: 'IMPALA'
  1. IMPALA
  2. IMPALA-11870

row__id of ACID tables don't work with Ranger column/row masking policies

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Open
    • Major
    • Resolution: Unresolved
    • None
    • None
    • Frontend, Security
    • None
    • ghx-label-2

    Description

      "row__id" is a synthetic column that only exists in full ACID tables. If there are Ranger column-masking/row-filtering policies applied on the table, it can't be resolved in many cases.

      For instance, creating a column-masking policy on table functional_orc_def.alltypestiny that mask column "id" to "id * 100". The following queries would fail:

      select id, row__id.* from functional_orc_def.alltypestiny;
      ERROR: AnalysisException: Could not resolve star expression: 'row__id.*'
      
      select id, row__id.rowid from functional_orc_def.alltypestiny;
      ERROR: AnalysisException: Could not resolve column/field reference: 'row__id.rowid'

      Note that it still works in some cases, e.g.

      select row__id.* from functional_orc_def.alltypestiny;
      +-----------+---------------------+-----------+-------+--------------------+
      | operation | originaltransaction | bucket    | rowid | currenttransaction |
      +-----------+---------------------+-----------+-------+--------------------+
      | 0         | 5                   | 536870912 | 0     | 5                  |
      | 0         | 5                   | 536870912 | 1     | 5                  |
      | 0         | 5                   | 536870912 | 0     | 5                  |
      | 0         | 5                   | 536870912 | 1     | 5                  |
      | 0         | 5                   | 536870912 | 0     | 5                  |
      | 0         | 5                   | 536870912 | 1     | 5                  |
      | 0         | 5                   | 536870912 | 0     | 5                  |
      | 0         | 5                   | 536870912 | 1     | 5                  |
      +-----------+---------------------+-----------+-------+--------------------+
      

      The failed cases are all using the "row__id" column with normal columns together.

      CC boroknagyz, fangyurao 

      Attachments

        Activity

          People

            Unassigned Unassigned
            stigahuang Quanlong Huang
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: