Oracle® Database Vault Administrator's Guide 11g Release 1 (11.1) Part Number B31222-01 |
|
|
View PDF |
The DVSYS.DBMS_MACUTL
package provides a set of general purpose utility functions that you can use throughout the application code you write for Oracle Database Vault. This package is available to all users.
This chapter includes the following topics:
Table G-1 summarizes field (that is, constant) descriptions for the DVSYS.DBMS_MACUTL
package.
Table G-1 DVSYS.DBMS_MACUTL Field Summary
FIeld Name | Data Type | Description |
---|---|---|
|
|
Realm Objects: Wildcard to indicate all object names or all object types |
|
|
Factor |
|
|
|
|
|
Factor |
|
|
Factor |
|
|
Factor |
|
|
Factor |
|
|
Factor |
|
|
Factor |
|
|
|
|
|
Code groups: |
|
|
Code groups: Database object types |
|
|
Code groups: DDL commands. |
|
|
Code groups: Factor |
|
|
Code groups: Factor |
|
|
Code groups: Factor |
|
|
Code groups: Factor |
|
|
Code groups: Factor |
|
|
Code groups: Oracle Label Security Policy merge algorithms |
|
|
Code groups: Oracle Database Vault Error messages |
|
|
Code groups: SQL relational operators |
|
|
Code groups: Realm |
|
|
Code groups: Rule Set |
|
|
Code groups: Rule set |
|
|
Code groups: Rule set handler_options |
|
|
Code groups: Rule set |
|
|
Code groups: SQL statements |
|
|
Factors: The term context in the field name refers to the application context capability in Oracle Database. |
|
|
Factor labels: The term context in the field name refers to the application context capability in Oracle Database. |
|
|
The access control and Oracle Label Security context start with this field name The term context in the field name refers to the application context capability in Oracle Database. |
|
|
Realm: The term context in the field name refers to the application context capability in Oracle Database. |
|
|
Session Labels: The term context in the field name refers to the application context capability in Oracle Database. |
|
|
Factor |
|
|
|
|
|
|
|
|
Fail_options: Fail with no message |
|
|
Fail_options: Fail with message |
|
|
Factor |
|
|
Factor |
|
|
Factor |
|
|
Factor |
|
|
Factor |
|
|
Factor |
|
|
Factor |
|
|
This is the highest label a user could set based on the factors. It does not take into account the label for a user. |
|
|
The label that a factor with a null label defaults to |
|
|
No constant for enabled and |
|
|
The Oracle Label Security session label for a user at the time |
|
|
|
|
|
Realm |
|
|
Realm |
|
|
Realm authorizations: Owner |
|
|
Realm authorizations: Participant |
|
|
|
|
|
Rule set |
|
|
Rule set |
|
|
Rule set |
|
|
Rule set |
|
|
Rule set |
|
|
Rule set |
|
|
Rule set |
|
|
Rule set |
|
|
Rule set |
|
|
This is what Oracle Label Security has decided the user's label should be set to after factoring in the preceding values. |
|
|
Yes constant for enabled and |
Table G-2 lists the functions in the DVSYS.DBMS_MACUTL
package.
Table G-2 DVSYS.DBMS_MACUTL Utility Functions
Function | Descriptions |
---|---|
CHECK_DVSYS_DML_ALLOWED Function |
Verifies that public-packages are not being bypassed by users updating the Oracle Database Vault configuration. |
|
Looks up the ID for a code within a code group; returns a |
|
Looks up the value for a code within a code group; returns a |
|
Constructs an XML document that contains the values for all of the factors; returns a Use this function to retrieve factors at the current time for a session. It is also useful for auditing purposes. |
|
Returns the seconds in Oracle SS format (00-59); returns a |
|
Returns the minute in Oracle MI format (00–59); returns a |
|
Returns the month in Oracle HH24 format (00–23); returns a |
|
Returns the day in Oracle DD format (01–31); returns a |
|
Returns the month in Oracle MM format (01–12); returns a |
|
Returns the year in Oracle YYYY format (0001–9999); returns a |
|
Checks for a string in the PL/SQL call stack; returns a |
|
Concatenates the elements of |
|
Checks whether the character is alphabetic; returns a |
|
Checks whether the character is numeric; returns a |
|
Determines whether a user is authorized to manage the Oracle Database Vault configuration; returns a |
|
Returns an indicator as to whether or not Oracle Label Security is installed; returns a |
IS_OLS_INSTALLED_VARCHAR Function |
Returns an indicator as to whether or not Oracle Label Security is installed; returns a |
RAISE_UNAUTHORIZED_OPERATION Function |
|
|
Looks up an Oracle RDBMS error message; returns a |
|
Looks up an Oracle RDBMS error message; returns a |
|
Alters a string to make it a legal Oracle identifier; returns a |
USER_HAS_OBJECT_PRIVILEGE Function |
Checks whether a user or role may access an object through an object privilege grant; returns a |
|
Checks whether a user has a role privilege, directly or indirectly (through another role); returns a |
USER_HAS_ROLE_VARCHAR Function |
Checks whether a user has a role privilege, directly or indirectly (through another role); returns a |
USER_HAS_SYSTEM_PRIVILEGE Function |
Checks whether a user has a system privilege, directly or indirectly (through a role); returns a |
This function verifies that public packages are not being bypassed by users updating the Oracle Database Vault configuration.
Syntax
CHECK_DVSYS_DML_ALLOWED( p_user VARCHAR2 DEFAULT USER);
Parameter
Table G-3 CHECK_DVSYS_DML_ALLOWED Parameter
Parameter | Description |
---|---|
|
User performing the operation. To find existing users in the current database instance, use the following views:
|
This function looks up the ID for a code within a code group, and then returns a NUMBER
value. These codes are used for the user interface, views, and for validating input in a translatable fashion.
Syntax
GET_CODE_ID( p_code_group VARCHAR2, p_code VARCHAR2);
Parameters
Table G-4 GET_CODE_ID Parameters
Parameter | Description |
---|---|
|
Code group, for example, To find available code groups in the current database instance, use the |
|
Value of the code from This value is listed when you run the |
This function looks up the value for a code within a code group, and then returns a VARCHAR2
value.
Syntax
GET_CODE_VALUE( p_code_group VARCHAR2, p_code VARCHAR2);
Parameters
Table G-5 GET_CODE_VALUE Parameters
Parameter | Description |
---|---|
|
Code group, for example, To find existing code groups in the current database instance, use the |
|
ID of the code. This ID is listed when you run the |
This function constructs an XML document that contains the values for all of the factors. This XML document is only intended for auditing or tracing and is truncated if it is longer than 4000 characters. The function returns a VARCHAR2
value.
Use this function to retrieve factors at the current time for a session. It is also useful for auditing purposes.
Syntax
GET_FACTOR_CONTEXT();
Parameters
None.
This function returns the seconds in Oracle SS (seconds) format (00–59), and then returns a NUMBER
value. It is useful for rule expressions based on time data.
Syntax
GET_SECOND( p_date DATE DEFAULT SYSDATE);
Parameter
This function returns the minute in Oracle MI (minute) format (00–59); returns a NUMBER
value. Useful for rule expressions based on time data.
Syntax
GET_MINUTE( p_date DATE DEFAULT SYSDATE);
Parameter
Table G-7 GET_MINUTE Parameter
Parameter | Description |
---|---|
|
Date in MI format, for example, If you do not specify a date, Oracle Database Vault uses the Oracle Database |
This function returns the hour in Oracle HH24 (hour) format (00–23); returns a NUMBER
value. Useful for rule expressions based on time data.
Syntax
GET_HOUR( p_date DATE DEFAULT SYSDATE);
Parameter
Table G-8 GET_HOUR Parameter
Parameter | Description |
---|---|
|
Date in HH24 format, for example, If you do not specify a date, Oracle Database Vault uses the Oracle Database |
This function returns the day in Oracle DD (day) format (01–31); returns a NUMBER
value. It is useful for rule expressions based on time data.
Syntax
GET_DAY( p_date DATE DEFAULT SYSDATE);
Parameter
Table G-9 GET_DAY Parameter
Parameter | Description |
---|---|
|
Date in DD format, for example, If you do not specify a date, Oracle Database Vault uses the Oracle Database |
This function returns the month in Oracle MM (month) format (01–12); returns a NUMBER
value. Useful for rule expressions based on time data.
Syntax
GET_MONTH( p_date DATE DEFAULT SYSDATE);
Parameter
This function returns the year in Oracle YYYY (year) format (0001–9999); returns a NUMBER
value. Useful for rule expressions based on time data.
Syntax
GET_YEAR( p_date DATE DEFAULT SYSDATE);
Parameter
This function concatenates the elements of ora_name_list_t
into a single VARCHAR2
value, and then returns a VARCHAR2
value.
Syntax
GET_SQL_TEXT( p_sql_text ora_name_list_t);
Parameters
This function checks for a string in the PL/SQL call stack, and then returns a BOOLEAN
value. IN_CALL_STACK
returns TRUE if the string is in the call stack.
Syntax
IN_CALL_STACK( p_search_term VARCHAR2);
Parameter
This function checks whether the character is alphabetic, and then returns a BOOLEAN
value. IS_ALPHA
returns TRUE if the character is alphabetic.
Syntax
IS_ALPHA( c VARCHAR2);
Parameter
This function checks whether the character is numeric, and then returns a BOOLEAN
value. IS_DIGIT
returns TRUE if the character is a digit.
Syntax
IS_DIGIT( c VARCHAR2);
Parameter
This function determines whether a user is authorized to manage the Oracle Database Vault configuration, and then returns a BOOLEAN
value. IS_DVSYS_OWNER
returns TRUE if the user is authorized.
Syntax
IS_DVSYS_OWNER( p_user VARCHAR2 DEFAULT USER);
Parameter
Table G-16 IS_DVSYS_OWNER Parameter
Parameter | Description |
---|---|
|
User to check. To find existing users, use the following views:
|
This function returns an indicator as to whether or not Oracle Label Security is installed, and then returns a TRUE or FALSE BOOLEAN
value. If Oracle Label Security is installed, IS_OLS_INSTALLED
returns TRUE.
Syntax
IS_OLS_INSTALLED()
Parameters
None.
This function returns an indicator as to whether or not Oracle Label Security is installed, and then returns a Y or N VARCHAR2
value. If Oracle Label Security is installed, IS_OLS_INSTALLED_VARCHAR
returns Y.
Syntax
IS_OLS_INSTALLED_VARCHAR()
Parameters
None.
This function looks up an Oracle RDBMS error message, and then returns a VARCHAR2
value.
Syntax
GET_MESSAGE_LABEL( p_message_code VARCHAR2);
Parameters
Table G-17 GET_MESSAGE_LABEL Parameter
Parameter | Description |
---|---|
|
Message code. See Oracle Database Error Messages for a listing of error messages. |
|
Value to substitute for %1 |
|
Value to substitute for %2 |
|
Value to substitute for %3 |
|
Value to substitute for %4 |
|
Value to substitute for %5 |
|
Value to substitute for %6 |
This function looks up an Oracle RDBMS error message, and then returns a NUMBER
value.
Syntax
GET_MESSAGE_LABEL( p_message_code NUMBER);
Parameters
Table G-18 GET_MESSAGE_LABEL Parameter
Parameter | Description |
---|---|
|
Message code. See Oracle Database Error Messages for a listing of error messages. |
|
Value to substitute for %1 |
|
Value to substitute for %2 |
|
Value to substitute for %3 |
|
Value to substitute for %4 |
|
Value to substitute for %5 |
|
Value to substitute for %6 |
This function generates an ORA-20920 (Unauthorized Operation) error for unauthorized users.
Syntax
RAISE_UNAUTHORIZED_OPERATION( p_user VARCHAR2 DEFAULT USER);
Parameter
Table G-19 RAISE_UNAUTHORIZED_OPERATION Parameter
Parameter | Description |
---|---|
|
User performing the operation. To find existing users, use the following views:
|
This function turns string into a legal Oracle identifier, and then returns a VARCHAR2
value.
Syntax
TO_ORACLE_IDENTIFIER( id VARCHAR2);
Parameter
This function checks whether a user or role may access an object through an object privilege grant, and then returns a BOOLEAN
value. If the user or role has object privileges, then USER_HAS_OBJECT_PRIVILEGE
returns TRUE.
Syntax
USER_HAS_OBJECT_PRIVILEGE( p_user VARCHAR2, p_object_owner VARCHAR2, p_object_name VARCHAR2, p_privilege VARCHAR2);
Parameters
Table G-21 USER_HAS_OBJECT_PRIVILEGE Parameters
Parameter | Description |
---|---|
|
User or role to check. To find existing users, use the following views:
|
|
Object owner. To find the available users, use the To find the authorization of a particular user, use the |
|
Object name. To find the available objects, use the To find objects that are secured by existing realms, use the |
|
Object privilege, for example, To find privileges for a database account excluding |
This function checks whether a user has a role privilege, directly or indirectly (through another role), and then returns a BOOLEAN
value. If the user has a role privilege, then USER_HAS_ROLE
returns TRUE.
Syntax
USER_HAS_ROLE( p_role VARCHAR2, p_user VARCHAR2 DEFAULT USER);
Parameters
Table G-22 USER_HAS_ROLE Parameters
Parameter | Description |
---|---|
|
Role privilege to check. To find existing roles, use the following views:
|
|
User to check. To find existing users, use the following views:
|
This function checks whether a user has a role privilege, directly or indirectly (through another role), and then returns a VARCHAR2
value. If the user has the role privilege specified, then USER_HAS_ROLE_VARCHAR
returns Y.
Syntax
USER_HAS_ROLE_VARCHAR( p_role VARCHAR2, p_user VARCHAR2 DEFAULT USER);
Parameters
Table G-23 USER_HAS_ROLE_VARCHAR Parameters
Parameter | Description |
---|---|
|
Role to check. To find existing roles, use the following views:
|
|
User to check. To find existing users, use the following views:
|
This function checks whether a user has a system privilege, directly or indirectly (through a role), and then returns a BOOLEAN
value. If the user has the system privilege specified, then USER_HAS_SYSTEM_PRIVILEGE
returns TRUE.
Syntax
USER_HAS_SYSTEM_PRIVILEGE( p_privilege VARCHAR2, p_user VARCHAR2 DEFAULT USER);
Parameters
Table G-24 USER_HAS_SYSTEM_PRIVILEGE Parameters
Parameter | Description |
---|---|
|
System privilege to check for. To find privileges for a database account excluding |
|
User to check. To find existing users, use the following views:
|