E Reference

E.1.1 Oracle Database Data Dictionary Tables

Oracle Label Security does not in any way label the Oracle data dictionary tables. Access is controlled by standard Oracle Database system and object privileges. For a description of all data dictionary tables and views, refe to the Oracle Database Reference.

E.1.2 Oracle Label Security Data Dictionary Views

Oracle Label Security maintains an independent set of data dictionary tables. These tables are exempt from any policy enforcement. This section lists the views that can display information related to Oracle Label Security.

Note that access to the DBA views is granted by default to the SELECT_CATALOG_ROLE, a standard Oracle Database role that lets you examine the Oracle Database data dictionary.

E.1.3 Oracle Label Security Auditing Views

Using the SA_AUDIT_ADMIN.CREATE_VIEW procedure, you can create an audit trail view for a specific policy. By default, this view is named DBA_policyname_AUDIT_TRAIL.

The DBA_SA_AUDIT_OPTIONS view contains the columns POLICY_NAME, USER_NAME, APY, SET_, and PRV.

E.2.1 CREATE TABLE AS SELECT Restriction in Oracle Label Security

If you attempt to perform CREATE TABLE AS SELECT in a schema that is protected by an Oracle Label Security policy, then the statement will fail.

E.2.2 Label Tag Restriction

Label tags must be unique across the policies in the database. When you use multiple policies in a database, you cannot use the same numeric label tag in different policies.

E.2.3 Export Restriction in Oracle Label Security

The LBACSYS schema cannot be exported due to the use of opaque types in Oracle Label Security. An export of the entire database (parameter FULL=Y) with Oracle Label Security installed can be done, except that the LBACSYS schema would not be exported.

E.2.4 Oracle Label Security Removal Restriction

Do not perform a DROP USER CASCADE on the LBACSYS account.

Connect to the database as user SYS, using the AS SYSDBA syntax, and run the file $ORACLE_HOME/rdbms/admin/catnools.sql to remove Oracle Label Security.

E.2.5 Shared Schema Support

User accounts defined in the Oracle Internet Directory cannot be given individual Oracle Label Security authorizations. However, authorizations can be given to the shared schema to which the directory users are mapped.

The Oracle Label Security function SET_ACCESS_PROFILE can be used programmatically to set the label authorization profile to use after a user has been authenticated and mapped to a shared schema. Oracle Label Security does not enforce a mapping between users who are given label authorizations in Oracle Label Security and actual database users.

E.2.6 Hidden Columns Restriction

PL/SQL does not recognize references to hidden columns in tables. A compiler error will be generated.

E.3.1 Oracle Label Security and the SYS.AUD$ Table

Installing Oracle Label Security automatically moves the AUD$ table out of SYS, and into SYSTEM.

Having the AUD$ table in the SYSTEM schema is supported when Oracle Label Security is being used.

When Oracle Label Security is not installed, moving the SYS.AUD$ table out of the SYS tablespace is not supported because the Oracle code makes implicit assumptions about the data dictionary tables, such as SYS.AUD$, in support of upgrades and backup/recovery scenarios. Moving SYS.AUD$ is not supported unless done by Oracle when Oracle Label Security is installed.