You can use trusted stored program units to enhance system security.
Topics:
Oracle Database stored procedures, functions, and packages are sets of PL/SQL statements stored in a database in compiled form.
The single difference between functions and procedures is that functions return a value and procedures do not. Trusted stored program units are like any other stored program units in Oracle Database: the underlying logic is the same.
A package is a set of procedures and functions, together with the cursors and variables they use, stored as a unit. There are two parts to a package, the package specification and the package body. The package specification declares the external definition of the public procedures, functions, and variables that the package contains. The package body contains the actual text of the procedures and functions, as well as any private procedures and variables.
A trusted stored program unit is a stored procedure, function, or package that has been granted one or more Oracle Label Security privileges. Trusted stored program units are typically used to let users perform privileged operations in a controlled manner, or update data at several labels. This is the optimal approach to permit users to access data beyond their authorization.
Trusted stored program units provide fine-grained control over the use of privileges. Although you can potentially grant privileges to many users, the granting of privileges should be done with great discretion because it might violate the security policy established for your application. Rather than assigning privileges to users, you can identify any application operations requiring privileges, and implement them as trusted program units. When you grant privileges to these stored program units, you effectively restrict the Oracle Label Security privileges required by users. This approach employs the principle of least privilege.
For example, if a user with the label CONFIDENTIAL needs to insert data into SENSITIVE rows, then you can grant the WRITEUP privilege to a trusted stored program to which the user has access. In this way, the user can perform the task by means of the trusted stored program, while staying at the CONFIDENTIAL level.
The trusted program unit performs all the actions on behalf of the user. You can thus effectively encapsulate the security policy into a module that can be verified to make sure that it is valid.
A trusted stored program unit runs using its own privileges, and the caller's labels. In this way, it can perform privileged operations on the set of rows constrained by the user's labels.
Oracle Database system and object privileges are intended to be bundled into roles. Users are then granted roles as necessary. By contrast, Oracle Label Security privileges can only be assigned to users or to stored program units. These trusted stored program units provide a more manageable mechanism than roles to control the use of Oracle Label Security privileges.
A trusted stored program unit with the READ privilege can read all unprotected data and all data protected by this policy in the database.
Consider, for example, a user who is responsible for creating purchasing forecast reports. The user must perform a summation operation on the amount of all purchases. Regardless of whether or not user's own labels authorize access to the individual purchase orders. The syntax for creating the summation procedure in this example is as follows:
CREATE FUNCTION sum_purchases RETURN NUMBER IS psum NUMBER; BEGIN SELECT SUM(amount) INTO psum FROM purchase_orders; RETURN psum; END sum_purchases;
In this way, the program unit can gather information the end user is not able to gather, and can make it available by means of a summation.
Note that to run SUM_PURCHASES, the user would need to be granted the standard Oracle Database EXECUTE object privilege upon this procedure.
See Also:
You can create and compile trusted stored program units for use in Oracle Label Security.
Topics:
You can create a trusted stored program unit in the same way that you create a standard procedure, function, or package, that is by using the CREATE PROCEDURE, CREATE FUNCTION, or CREATE PACKAGE and CREATE PACKAGE BODY statements.
The program unit becomes trusted when you grant it Oracle Label Security privileges.
When a developer creates a stored program unit, the Oracle Label Security administrator can verify the correctness of the code before granting the necessary privileges to the stored program unit.
Whenever the trusted stored program unit is re-created or replaced, its privileges are removed. The Oracle Label Security administrator must then verify the code again and grant the privileges once again.
Note:
When you create a trusted stored program unit, have the Oracle Label Security administrator review it carefully and evaluate the privileges you are granting to it. Ensure, for example, that procedures in trusted packages do not perform privileged database operations and then write result or status information into a public variable of the package. In this way, you can make sure that no violations of your site's Oracle Label Security policy can occur.
See Also:
Oracle Label Security privileges are revoked if you perform a CREATE OR REPLACE operation on a trusted stored program unit. This limits the potential for misuse of a procedure's Oracle Label Security privileges.
Note that the procedure, function, or package can still run even if the Oracle Label Security privileges have been removed.
If you re-create a procedure, function, or package, then you should carefully review its text. When you are certain that the re-created program unit does not violate your site's Oracle Label Security policy, you can then grant it the required privileges again.
In a development environment where trusted stored program units must frequently be replaced (for example, during the first few months of a live system), it is advisable to create a script that can grant the proper Oracle Label Security privileges, as required.
Under Oracle Label Security all the standard Oracle Database controls on procedure call (regarding access to tables and schemas) are still in force. Oracle Label Security complements these security mechanisms by controlling access to rows.
When a trusted stored program unit is carried out, the policy privileges in force are a union of the invoking user's privileges and the program unit's privileges. Whether a trusted stored program unit calls another trusted program unit or a non-trusted program unit, the program unit called runs with the same privileges as the original program unit.
If a sequence of non-trusted and trusted stored program units is carried out, the first trusted program unit will determine the privileges of the entire calling sequence from that point on. Consider the following sequence:
WRITEUPWRITEDOWNHere, Procedures B, C, and D all runs with the WRITEUP privilege, because B was the first trusted procedure in the sequence. When the sequence ends, the privilege pertaining to Procedure B is no longer in force for subsequent procedures.
You can use the SA_UTL package for several functions within PL/SQL programs that return information about the current values of the session security attributes, in the form of numeric label values.
Although these functions can be used in program units that are not trusted, they are primarily for use in trusted stored program units.
Note that these are public functions; you do not need the policy_DBA role to use them. In addition, each of the functions has a parallel SA_SESSION function that returns the same labels in character string format.
See Also:
"Duties of Oracle Label Security Administrators" for information about the policy_DBA role