[go: up one dir, main page]

[Static Masking] Improve Selective Masking

Selective Masking allows user to reduce the "scope" of the maskings rules applied on a table with

SECURITY LABEL FOR anon ON COLUMN user.login 
IS "MASKED WITH FUNCTION anon.dummy_username()";

SECURITY LABEL FOR anon ON TABLE user 
IS "MASKED WHEN NOT is_admin";

Which would currenlty be translated into

UPDATE user
SET login = CASE
    WHEN is_admin 
    THEN anon.dummy_username()
    ELSE login
;

This rewrite the entire table and if the WHEN clause has a high selectivity we're going to waste a lot of I/O rewriting the same values in most lines...

A better approach would be to apply the predicate at the lower level:

UPDATE user
SET login = anon.dummy_username();
WHERE is_admin
;
Edited by damien clochard