行过滤和列脱敏

[yiluoya]

column masking
example：

customer table as follow ，the telephone num is sensitive ，don't want be select by user A。 but user B can view all data。

solution ：
add function at table customer column telephone for user A。
then user A do ： select * from customer :

at user B's view： select * from customer :

row filter

example ：table order

hope user A only can view data ‘省份’ is ‘湖南’。

solution ：
add express at table order for user A
then when user A do ： select * from order

next is i implement example：

`CREATE database ods;
use ods;

CREATE TABLE test_chen
(
a varchar(10)
,b int
)
ENGINE=olap
DISTRIBUTED BY HASH(a) BUCKETS 32
PROPERTIES(
"storage_type"="column",
"replication_num"="1"
);

insert into test_chen values("1",1);
insert into test_chen values("2",2);
insert into test_chen values("3",-1);`

row filter ：

>> GRANT FILTER_PRIV ON ods.test_chen TO 'root' WITH a > 1;

SELECT * FROM ods.test_chen tc ;

column mask：

GRANT MASK_PRIV ON ods.test_chen TO 'root' COLUMN b WITH abs(b);

show grants

SHOW GRANTS for 'root'

priv revoke

REVOKE FILTER_PRIV ON ods.test_chen FROM 'root' REVOKE MASK_PRIV ON ods.test_chen FROM 'root' COLUMN b

propose:
is it a good way use mask_priv/filter_priv to grant ?

for huawei gsDB

https://support.huaweicloud.com/devg2-dws/dws_0402_0042.html

SELECT DBMS_REDACT.add_policy

for hive /presto user range

[ChPi]

问下你们脱敏是放在了be层吗？
我们之前也做过权限和脱敏但都是上层处理

[yiluoya]

sql 重写，在fe层

[abcchen2]

请问重写是在SQL语句解析前还是解析后？