Oracle ACFS security provides realm-based security for Oracle ACFS file systems, enabling you to create realms to specify security policies for users and groups to determine access on file system objects. This security feature provides a finer-grained access control on top of the access control provided by the operating system. Oracle ACFS security can use the encryption feature to protect the contents of realm-secured files stored in Oracle ACFS file systems.
Oracle ACFS security uses realms, rules, rule sets, and command rules to enforce security policies.
An Oracle ACFS security realm is a group of files or directories that are secured for access by a user or a group of users. Realms are defined with rule sets which contain groups of rules that apply fine grain access control. Oracle ACFS security realms can also be used as containers to enable encryption.
Oracle ACFS security rules are Boolean expressions that evaluate to true or false based on a system parameter on which the rule is based.
Oracle ACFS rule sets are collection of rules. Rule sets evaluate to TRUE or FALSE based on the evaluation of the rules a rule set contains.
Oracle ACFS command rules are associations of the file system operation to a rule set. For example, the association of a file system create, delete, or rename operation to a rule set. Command rules are associated with an Oracle ACFS realm.
An existing operating system user must be designated as the first Oracle ACFS security administrator and an existing operating system group must be designated as the security administrator admin group. Security administrators must be members of the designated security group. Additional users can be designated as security administrators. An Oracle ACFS security administrator can manage encryption for an Oracle ACFS file system on a per-realm basis. An Oracle ACFS security administrator is authenticated for security operations with a security realm password, not the operating system password of the user.
The first security administrator is created during the initialization of Oracle ACFS security with the acfsutil sec init command which is run by the root user. When the first security administrator is created, the administrator is assigned a password that can be changed by the administrator. Each time a security administrator runs an acfsutil sec command, the administrator is prompted for the security password. The security realm passwords for administrators are stored in a wallet created during the security initialization process. This wallet is located in the Oracle Cluster Registry (OCR).
Auditing and diagnostic data are logged for Oracle ACFS security. The log files include information such as acfsutil commands that have been run, the use of security or system administrator privileges, and run-time failures such as realm check authorization failures.
Auditing events, such as realm creation or encryption enabled, are written to these log files only if auditing is not enabled for on the file system. If auditing is enabled, these events are written into the audit trail. Diagnostic messages related to security and encryption are always written to the sec-hostname_fsid.log file regardless of whether auditing is enabled or not. For information about Oracle ACFS auditing, refer to "Oracle ACFS Auditing".
Logs are written to the following files:
mount_point/.Security/realm/logs/sec-hostname_fsid.log
The directory is created with acfsutil sec prepare command and protected by Oracle ACFS security. Refer to "acfsutil sec prepare".
GRID_HOME/log/hostname/acfs/security/acfssec.log
The messages that are logged to this file are for commands that are not associated with a specific file system, such as acfsutil sec init. The directory is created during installation and is owned by the root user.
When an active log file grows to a pre-defined maximum size (10 MB), the file is automatically moved to log_file_name.bak, the administrator is notified, and logging continues to the regular log file name. When the administrator is notified, the administrator must archive and remove the log_file_name.bak file. If an active log file grows to the maximum size and the log_file_name.bak file exists, logging stops until the backup file is removed. After the backup log file is removed, logging restarts automatically.
Oracle ACFS security protects the following objects from unauthorized accesses:
Realm-secured directories and user files
The directories and files reside on a file system secured by Oracle ACFS security.
The Oracle ACFS security directory (mount_point/.Security) and its contents
The security directory contains the log files in plain-text format and a security metadata backup file in XML format. The log files generated by Oracle ACFS security can only be accessed by valid Oracle ACFS security administrators.
Oracle ACFS security objects
These objects are the security realms, rules, and rule sets used to manage Oracle ACFS security.
Access to files in a security realm of an Oracle ACFS file system must be authorized by both the security realm and the underlying operating system permissions, such as (owner, group, other) permissions on Linux and Access Control Lists (ACLs) on Windows. Each access to a realm-secured file is first checked for security realm authorization. If the access is authorized by the security realm, then access to the files is checked by the underlying operating system access control checks. If both checks pass, access is allowed to the realm-secured file.
Note the following when working with Oracle ACFS security:
Oracle ACFS security does not provide any protection for data sent on the network.
A copy of a realm-protected file is not realm-protected unless the copy is made in a security realm-protected directory.
Some applications, such as the vi editor, re-create a file when the file is modified. The modified file is saved as a temporary file, the original file is removed, and temporary file is copied with the original file name as the destination name. This process creates a new file. If the new file is created in a realm-protected directory, the security policies of the realm also apply to the new file. If the new file is not created in a realm-protected directory, then the new file is not realm-protected. If you are planning to copy a realm-protected file, you should ensure that the parent directory is also security realm protected.
Security policies also apply to any temporary files created in a realm-protected directory.
To use Oracle ACFS security functionality on Linux, the disk group compatibility attributes for ASM and ADVM must be set to 11.2.0.2 or higher. To use Oracle ACFS security functionality on Windows, the disk group compatibility attributes for ASM and ADVM must be set to 11.2.0.3 or higher. For information about disk group compatibility, refer to "Disk Group Compatibility".
For information about Oracle ACFS security and snapshots, refer to "About Oracle ACFS Snapshots".
Security information for Oracle ACFS file systems is displayed in the V$ASM_ACFS_SECURITY_INFO view. For information about V$ASM_ACFS views, refer to Using Views to Display Oracle ACFS Information .
To configure security for Oracle ACFS file systems, you can use the acfsutil sec command-line functions described in "Securing Oracle ACFS File Systems" and "Oracle ACFS Command-Line Tools for Security". Also, you can use ASMCA described in "Managing Security and Encryption for Oracle ACFS with ASMCA".