10 Integrating Oracle Database Vault with Other Oracle Products

About Using Oracle Database Vault Factors with Oracle Label Security Policies

Oracle Database Vault controls the maximum security clearance for a database session by merging the maximum allowable data for each label in a database session by merging the labels of Oracle Database Vault factors that are associated to an Oracle Label Security policy.

In brief, a label acts as an identifier for the access privileges of a database table row. A policy is a name associated with the labels, rules, and authorizations that govern access to table rows. See Oracle Label Security Administrator's Guide for more information about row labels and policies.

Configuring Factors to Work with an Oracle Label Security Policy

You can define factors that contribute to the maximum allowable data label of an Oracle Label Security policy.

1. From Cloud Control, log into Oracle Database Vault Administrator as a user who has been granted the DV_OWNER or DV_ADMIN role.

   "Logging into Oracle Database Vault" explains how to log in.

2. Make the user LBACSYS account an owner of the realm that contains the schema to which a label security policy has been applied.

   This enables the LBACSYS account to have access to all the protected data in the realm, so that it can properly classify the data.

   The LBACSYS account is created in Oracle Label Security using the Oracle Universal Installer custom installation option. Before you can create an Oracle Label Security policy for use with Oracle Database Vault, you must make LBACSYS an owner for the realm you plan to use. See "About Realm Authorization" for more information.

3. Authorize the schema owner (on which the label security policy has been applied) as either a realm participant or a realm owner.

4. In the Administration page, under Database Vault Components, click OLS Integration.

   
   Description of the illustration ols_policies_integration.gif
   
   

5. In the Label Security Policies page:

   • To register a new label security policy with Database Vault, click Create.

   • To edit an existing label security policy that has been registered with Database Vault, select it from the list and then click Edit.

6. Enter the following settings:

   • Label Security Policy: From the list, select the Oracle Label Security policy that you want to use.

   • Algorithm: Optionally change the label-merging algorithm for cases when Oracle Label Security has merged two labels. In most cases, you may want to select LII - Minimum Level/Intersection/Intersection. This setting is the most commonly used method that Oracle Label Security administrators use when they want to merge two labels. This setting provides optimum flexibility when your applications must determine the resulting label that is required when combining two data sets that have different labels. It is also necessary for situations in which you must perform queries using joins on rows with different data labels.

     For more information on these label-merging algorithms, see Oracle Label Security Administrator's Guide. If you want to use the DBMS_MACADM package to specify a merge algorithm, see Table 18-3, "Oracle Label Security Merge Algorithm Codes" for a full listing of possible merge algorithms.

   • Label Security Policy Factors: In the Available Factors list under Label Security Policy Factors, select the factor that you want to associate with the Oracle Label Security policy. Then click Move to move the factor to the Selected Factors list. You can select multiple factors by holding down the Ctrl key as you click each factor that you want to select.

7. Click OK.

   The policy is listed in the Label Security Policies Integration page.

8. Label the factor identities using the labels for the policy.

   "Adding an Identity to a Factor" provides detailed information.

About This Tutorial

You can use Oracle Database Vault factors with Oracle Label Security and Oracle Virtual Private Database (VPD) technology to restrict access to sensitive data.

You can restrict this data so that it is only exposed to a database session when the correct combination of factors exists, defined by the security administrator, for any given database session.

Step 1: Create Users for This Tutorial

You must create two administrative users for this tutorial.

1. Log into the database instance as a user who has been granted the DV_ACCTMGR role.

   For example:

   sqlplus bea_dvacctmgr
   Enter password: password
   

2. In a multitenant environment, connect to the appropriate PDB.

   For example:

   CONNECT bea_dvacctmgr@hrpdb
   Enter password: password
   

   To find the available PDBs, query the DBA_PDBS data dictionary view. To check the current PDB, run the show con_name command.

3. Create the following local users:

   GRANT CREATE SESSION TO mdale IDENTIFIED BY password CONTAINER = CURRENT;
   GRANT CREATE SESSION TO jsmith IDENTIFIED BY password CONTAINER = CURRENT;
   

   Replace password with a password that is secure. See Oracle Database Security Guide for the minimum requirements for creating passwords.

4. Connect as a user who can grant system privileges and who has been granted the owner authorization for the Oracle System Privilege and Role Management realm, and then grant administrative privileges to users mdale and jsmith.

   CONNECT dba_psmith -- Or, CONNECT dba_psmith@hrpdb
   Enter password: password
   
   GRANT DBA TO mdale, jsmith;
   

   At this stage, users mdale and jsmith have identical administrative privileges.

Step 2: Create the Oracle Label Security Policy

Next, you are ready to create the Oracle Label Security policy and grants users the appropriate privileges for it.

1. In SQL*Plus, connect as the Oracle Label Security administrator, LBACSYS.

   CONNECT LBACSYS -- Or, CONNECT LBACSYS@hrpdb
   Enter password: password
   

   If user LBACSYS is locked and expired, connect as the Database Vault Account Manager, unlock and unexpire the LBACSYS account, and then log back in as LBACSYS.

   For example:

   CONNECT bea_dvacctmgr -- Or, CONNECT bea_dvaccmgr@hrpdb
   Enter password: password
   
   ALTER USER LBACSYS ACCOUNT UNLOCK IDENTIFIED BY password;
   
   CONNECT LBACSYS
   Enter password: password
   

2. Create a new Oracle Label Security policy:

   EXEC SA_SYSDBA.CREATE_POLICY('PRIVACY','PRIVACY_COLUMN','NO_CONTROL');
   

3. Create the following levels for the PRIVACY policy:

   EXEC SA_COMPONENTS.CREATE_LEVEL('PRIVACY',2000,'S','SENSITIVE');
   EXEC SA_COMPONENTS.CREATE_LEVEL('PRIVACY',1000,'C','CONFIDENTIAL');
   

4. Create the PII compartment.

   EXEC SA_COMPONENTS.CREATE_COMPARTMENT('PRIVACY',100,'PII','PERS_INFO');
   

5. Grant users mdale and jsmith the following labels:

   EXEC SA_USER_ADMIN.SET_USER_LABELS('PRIVACY','mdale','S:PII');
   EXEC SA_USER_ADMIN.SET_USER_LABELS('PRIVACY','jsmith','C'); 
   

   User mdale is granted the more sensitive label, Sensitive, which includes the PII compartment. User jsmith gets the Confidential label, which is less sensitive.

Step 3: Create Oracle Database Vault Rules to Control the OLS Authorization

After you have created the Oracle Label Security policy, you are ready to create Database Vault rules to work with it.

1. Connect to SQL*Plus as the Database Vault Owner.

   For example:

   CONNECT leo_dvowner -- Or, CONNECT leo_dvowner@hrpdb
   Enter password: password
   

2. Create the following rule set:

   EXEC DBMS_MACADM.CREATE_RULE_SET('PII Rule Set', 'Protect PII data from privileged users','Y',1,0,2,NULL,NULL,0,NULL);
   

3. Create a rule for the PII Rule Set.

   EXEC DBMS_MACADM.CREATE_RULE('Check OLS Factor',  'dominates(sa_utl.numeric_label(''PRIVACY''),  char_to_label(''PRIVACY'',''S:PII'')) = ''1''');
   

   Ensure that you use single quotes, as shown in this example, and not double quotes.

4. Add the Check OLS Factor rule to the PII Rule Set.

   EXEC DBMS_MACADM.ADD_RULE_TO_RULE_SET('PII Rule Set', 'Check OLS Factor');
   

Step 4: Update the ALTER SYSTEM Command Rule to Use the Rule Set

Before the rule set can be used, you must update the ALTER SYSTEM command rule, which is a default command rule.

1. As the Database Vault Owner, check the current value of the ALTER SYSTEM command rule, which is one of the default command rules when you install Oracle Database Vault.

   SELECT * FROM DVSYS.DBA_DV_COMMAND_RULE WHERE COMMAND = 'ALTER SYSTEM';
   

2. Make a note of these settings so that you can revert them to their original values later on.

   In a default installation, the ALTER SYSTEM command rule uses the Allow Fine Grained Control of System Parameters rule set, and is enabled.

3. Update the ALTER SYSTEM command rule to be associated with the PII Rule Set.

   EXEC DBMS_MACADM.UPDATE_COMMAND_RULE('ALTER SYSTEM', 'PII Rule Set', '%', '%', 'Y');
   

   This command adds the PII Rule Set to the ALTER SYSTEM command rule, applies it to all object owners and object names, and enables the command rule.

Step 5: Test the Authorizations

With all the components in place, you are ready to test the authorization.

1. In SQL*Plus, log on as user mdale.

   CONNECT mdale -- Or, CONNECT mdale@hrpdb
   Enter password: password
   

2. Check the current setting for the AUDIT_TRAIL initialization parameter.

   SHOW PARAMETER AUDIT_TRAIL
   
   NAME                                 TYPE        VALUE
   ------------------------------------ ----------- ----------------------
   audit_trail                          string      DB
   

   Make a note of this setting, so that you can revert it to its original setting later on.

3. As user mdale, use the ALTER SYSTEM statement to modify the CPU_COUNT parameter.

   ALTER SYSTEM SET CPU_COUNT = 4;
   System altered.
   

   Because user mdale was assigned the Sensitive label with the PII compartment, he can use the ALTER SYSTEM statement to modify the AUDIT_TRAIL system parameter.

4. Set the CPU_COUNT parameter back to its original value.

   For example:

   ALTER SYSTEM SET CPU_COUNT = 2;
   

5. Log in as user jsmith and then issue the same ALTER SYSTEM statement:

   CONNECT jsmith -- Or, CONNECT jsmith@hrpdb
   Enter password: password
   
   ALTER SYSTEM SET CPU_COUNT = 14;
   

   The following output should appear:

   ERROR at line 1:
   ORA-01031: insufficient privileges
   

   Because user jsmith was assigned only the Confidential label, he cannot perform the ALTER SYSTEM statement.

Step 6: Remove the Components for This Tutorial

You can remove the components that you created for this tutorial if you no longer need them.

1. Connect as the Oracle Label Security administrator and remove the label policy and its components.

   CONNECT LBACSYS -- Or, CONNECT LBACSYS@hrpdb
   Enter password: password
   
   EXEC SA_SYSDBA.DROP_POLICY('PRIVACY', TRUE);
   

2. Connect as the Oracle Database Vault Owner and issue the following commands in the order shown, to set the ALTER SYSTEM command rule back to its previous setting and remove the rule set.

   For example:

   CONNECT leo_dvowner
   Enter password: password
   
   EXEC DBMS_MACADM.UPDATE_COMMAND_RULE('ALTER SYSTEM', 'Allow System Parameters','%', '%', 'Y');
   EXEC DBMS_MACADM.DELETE_RULE_FROM_RULE_SET('PII Rule Set', 'Check OLS Factor');
   EXEC DBMS_MACADM.DELETE_RULE('Check OLS Factor');
   EXEC DBMS_MACADM.DELETE_RULE_SET('PII Rule Set');
   COMMIT;
   

3. Connect as the Database Vault Account Manager and remove users mdale and jsmith.

   CONNECT bea_dvacctmgr -- Or, CONNECT bea_dvacctmgr@hrpdb
   Enter password: password
   
   DROP USER mdale;
   DROP USER jsmith;