Oracle Label Security Administrators Guide 10g Release 2 (10.2) b14267

Description

Contents......Page 3 List of Figures......Page 15 List of Tables......Page 16 Documentation Accessibility......Page 19 Related Documentation......Page 20 Conventions......Page 21 Part I......Page 25 1 Introduction to Oracle Label Security......Page 27 Computer Security and Data Access Controls......Page 28 Oracle Label Security......Page 29 Oracle Label Security Architecture......Page 30 Overview of Oracle Label Security Policy Functionality......Page 31 Oracle Enterprise Edition: VPD Technology......Page 32 Label Policy Features......Page 33 Data Labels......Page 34 Oracle Label Security Integration with Oracle Internet Directory......Page 35 Introduction to Label-Based Security......Page 37 Label Component Definitions and Valid Characters......Page 38 Levels......Page 39 Compartments......Page 40 Groups......Page 42 Industry Examples of Levels, Compartments, and Groups......Page 43 Label Syntax and Type......Page 44 How Data Labels and User Labels Work Together......Page 45 Administering Labels......Page 47 Introducing Access Mediation......Page 49 The Session Label......Page 50 Session Label Example......Page 51 Authorized Levels......Page 52 Authorized Compartments......Page 53 Authorized Groups......Page 54 Introducing Read/Write Access......Page 55 Propagation of Read/Write Authorizations on Groups......Page 56 The Oracle Label Security Algorithm for Read Access......Page 57 The Oracle Label Security Algorithm for Write Access......Page 58 Special Access Privileges......Page 60 COMPACCESS......Page 61 PROFILE_ACCESS......Page 62 System Privileges, Object Privileges, and Policy Privileges......Page 63 Access Mediation and Program Unit Execution......Page 64 Access Mediation and Policy Enforcement Options......Page 65 Multiple Oracle Label Security Policies in a Distributed Environment......Page 66 Part II Using Oracle Label Security Functionality......Page 67 The Policy Label Column......Page 69 Example 2: Numeric Column Data Type with Hidden Column......Page 70 Manually Defining Label Tags to Order Labels......Page 71 Automatically Generated Label Tags......Page 72 Converting a Label Tag to a Character String, with LABEL_TO_CHAR......Page 73 Example 3:......Page 74 Using Numeric Label Tags in WHERE Clauses......Page 75 Ordering by Character Representation of Label......Page 76 Finding Greatest Lower Bound with GREATEST_LBOUND......Page 77 Merging Labels with the MERGE_LABEL Function......Page 78 Inserting Labeled Data......Page 79 Inserting Data When the Policy Label Column Is Hidden......Page 80 Inserting Labels Using TO_DATA_LABEL......Page 81 Changing the Session Label with SA_SESSION.SET_LABEL......Page 82 Restoring Label Defaults with SA_SESSION.RESTORE_DEFAULT_LABELS......Page 83 USER_SA_SESSION View to Return All Security Attributes......Page 84 Functions to Return Individual Security Attributes......Page 85 Introducing Label Management on Oracle Internet Directory......Page 87 Granting Permissions for Configuring Oracle Internet Directory enabled Oracle Label Security......Page 90 Task 2 Configure the Database for Oracle Internet Directory enabled Oracle Label Security......Page 91 Task3: Set the DIP Password and Connect Data......Page 92 Oracle Label Security Profiles......Page 93 Integrated Capabilities When Label Security Uses the Directory......Page 94 Oracle Label Security Policy Attributes in Oracle Internet Directory......Page 95 Two Types of Administrators......Page 96 Synchronizing the Database and Oracle Internet Directory......Page 97 Oracle Directory Integration and Provisioning (DIP) Provisioning Profiles......Page 98 Security Roles and Permitted Actions......Page 100 Restriction on Policy Creators for Directory-enabled Oracle Label Security......Page 101 Superseded PL/SQL Statements......Page 102 Procedures for Policy Administrators Only......Page 103 Part III Administering an Oracle Label Security Application......Page 105 Step 1: Create the Policy......Page 107 Step 4: Apply the Policy to Tables and Schemas......Page 108 Organizing the Duties of Oracle Label Security Administrators......Page 109 Oracle Policy Manager......Page 110 Using the SA_SYSDBA Package to Manage Security Policies......Page 111 Creating a Policy with SA_SYSDBA.CREATE_POLICY......Page 112 Disabling a Policy with SA_SYSDBA.DISABLE_POLICY......Page 113 Using the SA_COMPONENTS Package to Define Label Components......Page 114 Modifying a Level with SA_COMPONENTS.ALTER_LEVEL......Page 115 Creating a Compartment with SA_COMPONENTS.CREATE_COMPARTMENT......Page 116 Removing a Compartment with SA_COMPONENTS.DROP_COMPARTMENT......Page 117 Modifying a Group with SA_COMPONENTS.ALTER_GROUP......Page 118 Removing a Group with SA_COMPONENTS.DROP_GROUP......Page 119 Creating a Valid Data Label with SA_LABEL_ADMIN.CREATE_LABEL......Page 120 Modifying a Label with SA_LABEL_ADMIN.ALTER_LABEL......Page 121 Deleting a Label with SA_LABEL_ADMIN.DROP_LABEL......Page 122 Managing User Labels by Component, with SA_USER_ADMIN......Page 123 SA_USER_ADMIN.SET_COMPARTMENTS......Page 124 SA_USER_ADMIN.SET_GROUPS......Page 125 SA_USER_ADMIN.ADD_COMPARTMENTS......Page 126 SA_USER_ADMIN.DROP_ALL_COMPARTMENTS......Page 127 SA_USER_ADMIN.ALTER_GROUPS......Page 128 SA_USER_ADMIN.DROP_ALL_GROUPS......Page 129 SA_USER_ADMIN.SET_USER_LABELS......Page 130 SA_USER_ADMIN.SET_ROW_LABEL......Page 131 Managing User Privileges with SA_USER_ADMIN.SET_USER_PRIVS......Page 132 Returning User Name with SA_SESSION.SA_USER_NAME......Page 133 View to Display All User Security Attributes: DBA_SA_USERS......Page 134 Views to Display User Authorizations by Component......Page 135 Overview of Policy Enforcement Options......Page 137 LABEL_DEFAULT: Using the Session's Default Row Label......Page 141 READ_CONTROL: Reading Data......Page 142 The Overriding Enforcement Options......Page 143 Exemptions from Oracle Label Security Policy Enforcement......Page 144 Using a Labeling Function......Page 145 Understanding Labeling Functions in Oracle Label Security Policies......Page 146 Specifying a Labeling Function in a Policy......Page 147 Inserting Child Rows into Tables with Declarative Referential Integrity Enabled......Page 148 Evaluating Enforcement Control Options and UPDATE......Page 149 Deleting Labeled Data Using Policy Options and Labeling Functions......Page 150 Modifying an Oracle Label Security Policy with a SQL Predicate......Page 151 Affecting Oracle Label Security Policies with Multiple SQL Predicates......Page 152 Subscribing Policies in Directory-Enabled Label Security......Page 153 Policy Administration Functions for Tables and Schemas......Page 154 Syntax......Page 155 Disabling a Policy with SA_POLICY_ADMIN.DISABLE_TABLE_POLICY......Page 156 Administering Policies on Schemas with SA_POLICY_ADMIN......Page 157 Syntax......Page 158 Syntax......Page 159 Policy Issues for Schemas......Page 160 Introduction to Trusted Stored Program Units......Page 161 Managing Program Unit Privileges with SET_PROG_PRIVS......Page 162 Creating Trusted Stored Program Units......Page 163 Running Trusted Stored Program Units......Page 164 SA_UTL.SET_LABEL......Page 165 LEAST_UBOUND......Page 166 Overview of Oracle Label Security Auditing......Page 167 Enabling Oracle Label Security Auditing with SA_AUDIT_ADMIN......Page 168 Enabling Oracle Label Security Auditing with SA_AUDIT_ADMIN.AUDIT......Page 169 Disabling Oracle Label Security Auditing with SA_AUDIT_ADMIN.NOAUDIT......Page 170 Policy Label Auditing with SA_AUDIT_ADMIN.AUDIT_LABEL......Page 171 Creating a View with SA_AUDIT_ADMIN.CREATE_VIEW......Page 172 Strategy for Setting SA_AUDIT_ADMIN Options......Page 173 Auditing Privileged Operations......Page 174 An Oracle Label Security Distributed Configuration......Page 175 Connecting to a Remote Database Under Oracle Label Security......Page 176 Setting Up Labels in a Distributed Environment......Page 177 Setting Numeric Form of Label Components in a Distributed Environment......Page 178 Introduction to Replication Under Oracle Label Security......Page 179 Contents of a Materialized View......Page 180 Requirements for Creating Materialized Views Under Oracle Label Security......Page 181 Requirements for Creating Partial Multilevel Materialized Views......Page 182 How to Refresh Materialized Views......Page 183 Using the Export Utility with Oracle Label Security......Page 185 Verifying Import User Authorizations......Page 186 Importing Tables with Hidden Columns......Page 187 Oracle Label Security Input to SQL*Loader......Page 188 Creating Indexes on the Policy Label Column......Page 189 Planning a Label Tag Strategy to Enhance Performance......Page 190 Partitioning Data Based on Numeric Label Tags......Page 191 Creating Additional Databases After Installation......Page 192 Comparing Standard Groups and Inverse Groups......Page 195 How Inverse Groups Work......Page 196 Inverse Groups and Label Components......Page 197 Computed Session Labels with Inverse Groups......Page 198 Inverse Groups and Hierarchical Structure......Page 199 Algorithm for Read Access with Inverse Groups......Page 200 Algorithm for Write Access with Inverse Groups......Page 201 Algorithms for COMPACCESS Privilege with Inverse Groups......Page 202 Inverse Groups: Rules for Changing Initial Session/Row Labels......Page 203 Inverse Groups: Rules for Changing Current Session/Row Labels......Page 204 Inverse Groups Example 2......Page 205 SYSDBA.CREATE_POLICY with Inverse Groups......Page 206 SA_USER_ADMIN.ADD_GROUPS with Inverse Groups......Page 207 SA_USER_ADMIN.SET_USER_LABELS with Inverse Groups......Page 208 SA_USER_ADMIN.SET_ROW_LABEL with Inverse Groups......Page 209 LEAST_UBOUND with Inverse Groups......Page 210 Dominance Rules for Labels with Inverse Groups......Page 211 Part IV Appendixes......Page 213 Dominant and Dominated Labels......Page 215 The DOMINATES Standalone Function......Page 216 SA_UTL.STRICTLY_DOMINATES......Page 217 OCIAttrGet......Page 218 OCI Example......Page 219 B Command-line Tools for Label Security Using Oracle Internet Directory......Page 225 Command Explanations......Page 228 Summaries......Page 236 Examples of Using olsadmintool......Page 239 Create Some Compartments......Page 240 Set Some Audit Options......Page 241 Results of These Examples......Page 242 Oracle Label Security Data Dictionary Views......Page 243 ALL_SA_LABELS......Page 244 ALL_SA_SCHEMA_POLICIES......Page 245 ALL_SA_USER_LABELS......Page 246 DBA_SA_COMPARTMENTS......Page 247 DBA_SA_LEVELS......Page 248 DBA_SA_USERS......Page 249 DBA_SA_USER_LABELS......Page 250 Oracle Label Security Auditing Views......Page 251 Hidden Columns Restriction......Page 252 Removing Oracle Label Security......Page 253 Using Oracle Label Security Policy Functions in an RAC Environment......Page 255 Using Transparent Application Failover in Oracle Label Security......Page 256 C......Page 257 G......Page 258 L......Page 259 P......Page 260 S......Page 261 W......Page 262