6 Working with Labeled Data

You can convert character strings to a label tag This function returns the label tag for the specified character string..

• To convert a character string to a label tab, use the following syntax for the CHAR_TO_LABEL function:

  FUNCTION CHAR_TO_LABEL (
       policy_name     IN VARCHAR2,
       label_string    IN VARCHAR2)
  RETURN NUMBER; 
  
  

For example:

INSERT INTO emp (empno,hr_label) 
VALUES (999, CHAR_TO_LABEL('HR','S:A,B:G5');

Here, HR is the label policy name, S is a sensitivity level, A,B compartments, and G5 a group.

FUNCTION CHAR_TO_LABEL (
     policy_name     IN VARCHAR2,
     label_string    IN VARCHAR2)
RETURN NUMBER; 

Here, HR is the label policy name, S is a sensitivity level, A,B compartments, and G5 a group.

You can perform an ORDER BY referencing the policy label column to order rows by the numeric label tag value that the administrator has set.

• To perform the ORDER BY operation, use a SELECT statement similar to the following:

  SELECT * from emp
  ORDER BY hr_label;
  

Notice that no functions were necessary in this statement. The statement made use of label tags set up by the administrator.

Using the LABEL_TO_CHAR function, you can order data rows by the character representation of the label.

• To order data rows by the character representation of a label, use a statement similar to the following, which returns all rows sorted by the text order of the label :

  SELECT * FROM emp
  ORDER BY label_to_char (hr_label);
  

The MERGE_LABEL function merges two labels together. It accepts the character string form of two labels and the three-character specification of a merge format.

• To merge labels, use the following syntax:

  FUNCTION merge_label (label1 IN number,
                        label2 IN number,
                        merge_format IN VARCHAR2)
  RETURN number;
  

The valid merge format is specified with a three-character string:

<highest level or lowest level><union or intersection of compartments><union or intersection of groups>

• The first character indicates whether to merge using the highest level or the lowest level of the two labels.

• The second character indicates whether to merge using the union or the intersection of the compartments in the two labels.

• The third character indicates whether to merge using the union or the intersection of the groups in the two labels.

Table 6-5 defines the MERGE_LABEL format constants.

For example, HUI specifies the highest level of the two labels, union of the compartments, intersection of the groups.

The MERGE_LABEL function is particularly useful to developers if the LEAST_UBOUND function does not provide the intended result. The LEAST_UBOUND function, when used with two labels containing groups, may result in a less sensitive data label than expected. The MERGE_LABEL function enables you to compute an intersection on the groups, instead of the union of groups that is provided by the LEAST_UBOUND function.

For example, if the label of one data record contains the group UNITED_STATES, and the label of another data record contains the group UNITED_KINGDOM, and the LEAST_UBOUND function is used to compute the least upper bound of these two labels, then the resulting label would be accessible to users authorized for either the UNITED_STATES or the UNITED_KINGDOM.

If, by contrast, the MERGE_LABEL function is used with a format clause of HUI, then the resulting label would contain the highest level, the union of the compartments, and no groups. This is because UNITED_STATES and UNITED_KINGDOM do not intersect.

To insert a row label, you can specify the label character string and then transform it into a label using the CHAR_TO_LABEL function.

• To insert labels, use an INSERT INTO statement.

Using the definition for table emp, the following example shows how to insert data with explicit labels:

INSERT INTO emp (ename,empno,hr_label)
VALUES ('ESTANTON',10,char_to_label ('HR', 'SENSITIVE'));

You can insert data using the numeric label tag value of a label, rather than using the CHAR_TO_LABEL function.

• To insert labels using numeric label tag values, use an INSERT INTO statement.

For example, if the numeric label tag for SENSITIVE is 3000, it would appear as follows:

INSERT INTO emp (ename, empno, hr_label)
VALUES ('ESTANTON', 10, 3000);

If LABEL_DEFAULT is set, or if there is a labeling function applied to the table, then you do not need to specify a label in your INSERT statements. The label will be provided automatically.

• To insert data without specifying a label, use an INSERT INTO statement.

For example:

INSERT INTO emp (ename, empno)
VALUES ('ESTANTON', 10);

The resulting row label is set according to the default value (or by a labeling function).

If the label column is hidden, then the existence of the column is transparent to the insertion of data. INSERT statements can be written that do not explicitly list the table columns and do not include a value for the label column.

The session's row label is used to label the data, or a labeling function is used if one was specified when the policy was applied to the table or schema.

You can insert into a table without explicitly naming the columns, as long as you specify a value for each non-hidden column in the table. The following example shows how to insert a row into the table described in "Example 2: Numeric Column Data Type with Hidden Column":

• To insert data when the policy label column is hidden, use the following syntax:

  INSERT INTO emp
  VALUES ('196','ESTANTON',Technician,RSTOUT,50000,10);
  

Its label will be one of the following three possibilities:

• The label you specify

• The label established by the LABEL_DEFAULT option of the policy being applied

• The label created by a labeling function named by the policy being applied

  Note:

  If the policy label column is not hidden, then you must explicitly include a label value (possibly null, indicated by a comma) in the INSERT statement.

You can generate new labels dynamically by using the TO_DATA_LABEL function to guarantee that this produces valid data labels.

However, be aware that when Oracle Label Security is installed to work with Oracle Internet Directory, dynamic label generation is not allowed, because labels are managed centrally in Oracle Internet Directory, using olsadmintool commands. Refer to Command-line Tools for Label Security Using Oracle Internet Directory for more information. Therefore, when Oracle Label Security is directory-enabled, this function, TO_DATA_LABEL, is not available and will generate an error message if used.

1. Ensure that you have the EXECUTE privilege on the TO_DATA_LABEL function.

2. Use the TO_DATA_LABEL as necessary, for example, in an INSERT INTO statement.

For example:

INSERT INTO emp (ename, empno, hr_label)
VALUES ('ESTANTON', 10, to_data_label ('HR', 'SENSITIVE'));

Whereas the CHAR_TO_LABEL function requires that the label already be an existing data label for the transaction to succeed, the TO_DATA_LABEL does not have this requirement. It will automatically create a valid data label.