Skip Headers
Oracle® Database Vault Administrator's Guide
11g Release 1 (11.1)

Part Number B31222-01
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Index
Index
Go to Master Index
Master Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
View PDF

G Oracle Database Vault DVSYS.DBMS_MACUTL Package

The DVSYS.DBMS_MACUTL package provides a set of general purpose utility functions that you can use throughout the application code you write for Oracle Database Vault. This package is available to all users.

This chapter includes the following topics:

G.1 Field Summary

Table G-1 summarizes field (that is, constant) descriptions for the DVSYS.DBMS_MACUTL package.

Table G-1 DVSYS.DBMS_MACUTL Field Summary

FIeld Name Data Type Description

G_ALL_OBJECT

VARCHAR2(1)

Realm Objects: Wildcard to indicate all object names or all object types

G_AUDIT_ALWAYS

NUMBER

Factor audit_options: Always audit.

G_AUDIT_OFF

NUMBER

Factor audit_options: No audit.

G_AUDIT_ON_GET_ERROR

NUMBER

Factor audit_options: Audit if get_expr returns an error.

G_AUDIT_ON_GET_NULL

NUMBER

Factor audit_options: Audit if get_expr is null.

G_AUDIT_ON_TRUST_LEVEL_NEG

NUMBER

Factor audit_options: Audit if trust level is negative.

G_AUDIT_ON_TRUST_LEVEL_NULL

NUMBER

Factor audit_options: Audit if no trust level exists.

G_AUDIT_ON_VALIDATE_ERROR

NUMBER

Factor audit_options: Audit if validation function returns an error.

G_AUDIT_ON_VALIDATE_FALSE

NUMBER

Factor audit_options: Audit if validation function is false.

G_CODES_AUDIT_EVENTS

VARCHAR2(30)

Code groups: Audit event descriptions

G_CODES_BOOLEAN

VARCHAR2(30)

Code groups: BOOLEAN values

G_CODES_DB_OBJECT_TYPE

VARCHAR2(30)

Code groups: Database object types

G_CODES_DDL_CMDS

VARCHAR2(30)

Code groups: DDL commands.

G_CODES_FACTOR_AUDIT

VARCHAR2(30)

Code groups: Factor audit_options.

G_CODES_FACTOR_EVAL

VARCHAR2(30)

Code groups: Factor eval_options

G_CODES_FACTOR_FAIL

VARCHAR2(30)

Code groups: Factor fail_options

G_CODES_FACTOR_IDENTIFY

VARCHAR2(30)

Code groups: Factor identity_by

G_CODES_FACTOR_LABEL

VARCHAR2(30)

Code groups: Factor labeled_by

G_CODES_LABEL_ALG

VARCHAR(30)

Code groups: Oracle Label Security Policy merge algorithms

G_CODES_MESSAGES

VARCHAR(30)

Code groups: Oracle Database Vault Error messages

G_CODES_OPERATORS

VARCHAR2(30)

Code groups: SQL relational operators

G_CODES_REALM_AUDIT

VARCHAR2(30)

Code groups: Realm audit_options

G_CODES_RULESET_AUDIT

VARCHAR2(30)

Code groups: Rule Set audit_options

G_CODES_RULESET_EVAL

VARCHAR2(30)

Code groups: Rule set evaluate_options

G_CODES_RULESET_EVENT

VARCHAR2(30)

Code groups: Rule set handler_options

G_CODES_RULESET_FAIL

VARCHAR(30)

Code groups: Rule set fail_options

G_CODES_SQL_CMDS

VARCHAR2(30)

Code groups: SQL statements

G_CONTEXT_FACTOR

VARCHAR2(30)

Factors: MAC$FACTOR, factor name, factor value

The term context in the field name refers to the application context capability in Oracle Database.

G_CONTEXT_FACTOR_LABEL

VARCHAR2(30)

Factor labels: MAC$F$ policy, factor_name, factor label

The term context in the field name refers to the application context capability in Oracle Database.

G_CONTEXT_PREFIX

VARCHAR2(30)

The access control and Oracle Label Security context start with this field name

The term context in the field name refers to the application context capability in Oracle Database.

G_CONTEXT_REALM

VARCHAR2(30)

Realm: MAC$REALM, factor name, factor value

The term context in the field name refers to the application context capability in Oracle Database.

G_CONTEXT_SESSION_LABEL

VARCHAR2(30)

Session Labels: MAC$S$ policy, session attribute, label

The term context in the field name refers to the application context capability in Oracle Database.

G_EVAL_ON_ACCESS

NUMBER

Factor eval_options: Reevaluate on each access

G_EVAL_ON_SESSION

NUMBER

Factor eval_options: Evaluate once upon login

G_EVAL_ON_STARTUP

NUMBER

Factor eval_options: Evaluate once at database startup

G_FAIL_SILENTLY

NUMBER

Fail_options: Fail with no message

G_FAIL_WITH_MESSAGE

NUMBER

Fail_options: Fail with message

G_IDENTIFY_BY_CONSTANT

NUMBER

Factor identify_by column: Fixed value in get_expr column

G_IDENTIFY_BY_CONTEXT

NUMBER

Factor identify_by context

G_IDENTIFY_BY_FACTOR

NUMBER

Factor identify_by column: Subfactors through factor_link$ table

G_IDENTIFY_BY_METHOD

NUMBER

Factor identify_by column: Expression in get_expr column

G_IDENTIFY_BY_RULESET

NUMBER

Factor identify_by column: Expression and Rule Set with factor_expr$ table

G_LABELED_BY_FACTORS

NUMBER

Factor labeled_by column: Derive label from subfactor and merge algorithm

G_LABELED_BY_SELF

NUMBER

Factor labeled_by column: Factor's identities are labeled

G_MAX_SESSION_LABEL

VARCHAR2(30)

This is the highest label a user could set based on the factors. It does not take into account the label for a user.

G_MIN_POLICY_LABEL

VARCHAR2(30)

The label that a factor with a null label defaults to

G_NO

VARCHAR2(1)

No constant for enabled and label_ind columns (BOOLEAN FALSE)

G_OLS_SESSION_LABEL

VARCHAR2(30)

The Oracle Label Security session label for a user at the time init_session is run.

G_REALM_AUDIT_FAIL

NUMBER

Realm audit_options: Audit on realm violation.

G_REALM_AUDIT_OFF

NUMBER

Realm audit_options: No auditing

G_REALM_AUDIT_SUCCESS

NUMBER

Realm audit_options: Audit on successful realm access

G_REALM_AUTH_OWNER

NUMBER

Realm authorizations: Owner

G_REALM_AUTH_PARTICIPANT

NUMBER

Realm authorizations: Participant

G_RULESET_AUDIT_FAIL

NUMBER

Rule set audit_options: Audit on rule set failure

G_RULESET_AUDIT_OFF

NUMBER

Rule set audit_options: No auditing

G_RULESET_AUDIT_SUCCESS

NUMBER

Rule set audit_options: Audit on rule set success

G_RULESET_EVAL_ALL

NUMBER

Rule set eval_options: Rule set succeeds if all rules are TRUE

G_RULESET_EVAL_ANY

NUMBER

Rule set eval_options: Rule set succeeds if any rule is TRUE

G_RULESET_FAIL_SHOW

NUMBER

Rule set fail_options: Show error message

G_RULESET_FAIL_SILENT

NUMBER

Rule set fail_options: No error message

G_RULESET_HANDLER_FAIL

NUMBER

Rule set handler_options: Call handler on rule set failure

G_RULESET_HANDLER_OFF

NUMBER

Rule set handler_options: No call to handler

G_RULESET_HANDLER_SUCCESS

NUMBER

Rule set handler_options: Call handler on rule set success

G_USER_POLICY_LABEL

VARCHAR2(30)

This is what Oracle Label Security has decided the user's label should be set to after factoring in the preceding values.

G_YES

VARCHAR2(1)

Yes constant for enabled and label_ind columns (BOOLEAN TRUE)


G.2 Functions Within the DVSYS.DBMS_MACUTL Package

Table G-2 lists the functions in the DVSYS.DBMS_MACUTL package.

Table G-2 DVSYS.DBMS_MACUTL Utility Functions

Function Descriptions

CHECK_DVSYS_DML_ALLOWED Function


Verifies that public-packages are not being bypassed by users updating the Oracle Database Vault configuration.

GET_CODE_ID Function


Looks up the ID for a code within a code group; returns a NUMBER value.

GET_CODE_VALUE Function


Looks up the value for a code within a code group; returns a VARCHAR2 value.

GET_FACTOR_CONTEXT Function


Constructs an XML document that contains the values for all of the factors; returns a VARCHAR2 value. Useful for rule expressions based on time data.

Use this function to retrieve factors at the current time for a session. It is also useful for auditing purposes.

GET_SECOND Function


Returns the seconds in Oracle SS format (00-59); returns a NUMBER value. Useful for rule expressions based on time data.

GET_MINUTE Function


Returns the minute in Oracle MI format (00–59); returns a NUMBER value. Useful for rule expressions based on time data.

GET_HOUR Function


Returns the month in Oracle HH24 format (00–23); returns a NUMBER value. Useful for rule expressions based on time data.

GET_DAY Function


Returns the day in Oracle DD format (01–31); returns a NUMBER value. Useful for rule expressions based on time data.

GET_MONTH Function


Returns the month in Oracle MM format (01–12); returns a NUMBER value. Useful for rule expressions based on time data.

GET_YEAR Function


Returns the year in Oracle YYYY format (0001–9999); returns a NUMBER value. Useful for rule expressions based on time data.

IN_CALL_STACK Function


Checks for a string in the PL/SQL call stack; returns a BOOLEAN value.

GET_SQL_TEXT Function


Concatenates the elements of ora_name_list_t into a single VARCHAR2 value; returns a VARCHAR2 value.

IS_ALPHA Function


Checks whether the character is alphabetic; returns a BOOLEAN value.

IS_DIGIT Function


Checks whether the character is numeric; returns a BOOLEAN value.

IS_DVSYS_OWNER Function


Determines whether a user is authorized to manage the Oracle Database Vault configuration; returns a BOOLEAN value.

IS_OLS_INSTALLED Function


Returns an indicator as to whether or not Oracle Label Security is installed; returns a BOOLEAN value.

IS_OLS_INSTALLED_VARCHAR Function


Returns an indicator as to whether or not Oracle Label Security is installed; returns a VARCHAR2 value.

RAISE_UNAUTHORIZED_OPERATION Function


Generates an ORA-20920 (Unauthorized Operation) error

GET_MESSAGE_LABEL Function


Looks up an Oracle RDBMS error message; returns a VARCHAR2 value.

GET_MESSAGE_LABEL Function


Looks up an Oracle RDBMS error message; returns a VARCHAR2 value.

TO_ORACLE_IDENTIFIER Function


Alters a string to make it a legal Oracle identifier; returns a VARCHAR2 value.

USER_HAS_OBJECT_PRIVILEGE Function


Checks whether a user or role may access an object through an object privilege grant; returns a BOOLEAN value.

USER_HAS_ROLE Function


Checks whether a user has a role privilege, directly or indirectly (through another role); returns a BOOLEAN value.

USER_HAS_ROLE_VARCHAR Function


Checks whether a user has a role privilege, directly or indirectly (through another role); returns a VARCHAR2 value.

USER_HAS_SYSTEM_PRIVILEGE Function


Checks whether a user has a system privilege, directly or indirectly (through a role); returns a BOOLEAN value.


G.2.1 CHECK_DVSYS_DML_ALLOWED Function

This function verifies that public packages are not being bypassed by users updating the Oracle Database Vault configuration.

Syntax

CHECK_DVSYS_DML_ALLOWED(
  p_user VARCHAR2 DEFAULT USER); 

Parameter

Table G-3 CHECK_DVSYS_DML_ALLOWED Parameter

Parameter Description

p_user

User performing the operation.

To find existing users in the current database instance, use the following views:


G.2.2 GET_CODE_ID Function

This function looks up the ID for a code within a code group, and then returns a NUMBER value. These codes are used for the user interface, views, and for validating input in a translatable fashion.

Syntax

GET_CODE_ID(
  p_code_group VARCHAR2,
  p_code       VARCHAR2); 

Parameters

Table G-4 GET_CODE_ID Parameters

Parameter Description

p_code_group

Code group, for example, AUDIT_EVENTS or BOOLEAN.

To find available code groups in the current database instance, use the DBA_DV_CODE view, described in "Oracle Database Vault Public Views".

p_code

Value of the code from DBA_DV_CODE.

This value is listed when you run the DBA_DV_CODE view.


G.2.3 GET_CODE_VALUE Function

This function looks up the value for a code within a code group, and then returns a VARCHAR2 value.

Syntax

GET_CODE_VALUE(
  p_code_group VARCHAR2, 
  p_code       VARCHAR2); 

Parameters

Table G-5 GET_CODE_VALUE Parameters

Parameter Description

p_code_group

Code group, for example, AUDIT_EVENTS or BOOLEAN.

To find existing code groups in the current database instance, use the DBA_DV_CODE view, described in "Oracle Database Vault Public Views".

p_code

ID of the code.

This ID is listed when you run the DBA_DV_CODE view.


G.2.4 GET_FACTOR_CONTEXT Function

This function constructs an XML document that contains the values for all of the factors. This XML document is only intended for auditing or tracing and is truncated if it is longer than 4000 characters. The function returns a VARCHAR2 value.

Use this function to retrieve factors at the current time for a session. It is also useful for auditing purposes.

Syntax

GET_FACTOR_CONTEXT();

Parameters

None.

G.2.5 GET_SECOND Function

This function returns the seconds in Oracle SS (seconds) format (00–59), and then returns a NUMBER value. It is useful for rule expressions based on time data.

Syntax

GET_SECOND(
  p_date DATE DEFAULT SYSDATE);

Parameter

Table G-6 GET_SECOND Parameter

Parameter Description

p_date

Date in SS format, for example: 59.

If you do not specify a date, Oracle Database Vault uses the Oracle Database SYSDATE function to retrieve the current date and time set for the operating system on which the database resides.


G.2.6 GET_MINUTE Function

This function returns the minute in Oracle MI (minute) format (00–59); returns a NUMBER value. Useful for rule expressions based on time data.

Syntax

GET_MINUTE(
  p_date DATE DEFAULT SYSDATE);

Parameter

Table G-7 GET_MINUTE Parameter

Parameter Description

p_date

Date in MI format, for example, 30 (as is 2:30).

If you do not specify a date, Oracle Database Vault uses the Oracle Database SYSDATE function to retrieve the current date and time set for the operating system on which the database resides.


G.2.7 GET_HOUR Function

This function returns the hour in Oracle HH24 (hour) format (00–23); returns a NUMBER value. Useful for rule expressions based on time data.

Syntax

GET_HOUR(
  p_date DATE DEFAULT SYSDATE); 

Parameter

Table G-8 GET_HOUR Parameter

Parameter Description

p_date

Date in HH24 format, for example, 14 for 2:00 p.m.

If you do not specify a date, Oracle Database Vault uses the Oracle Database SYSDATE function to retrieve the current date and time set for the operating system on which the database resides.


G.2.8 GET_DAY Function

This function returns the day in Oracle DD (day) format (01–31); returns a NUMBER value. It is useful for rule expressions based on time data.

Syntax

GET_DAY(
  p_date DATE DEFAULT SYSDATE); 

Parameter

Table G-9 GET_DAY Parameter

Parameter Description

p_date

Date in DD format, for example, 01 for the first day of the month.

If you do not specify a date, Oracle Database Vault uses the Oracle Database SYSDATE function to retrieve the current date and time set for the operating system on which the database resides.


G.2.9 GET_MONTH Function

This function returns the month in Oracle MM (month) format (01–12); returns a NUMBER value. Useful for rule expressions based on time data.

Syntax

GET_MONTH(
  p_date DATE DEFAULT SYSDATE);

Parameter

Table G-10 GET_MONTH Parameter

Parameter Description

p_date

Date in MM format, for example, 08 for August.

If you do not specify a date, Oracle Database Vault uses the Oracle Database SYSDATE function to retrieve the current date and time set for the operating system on which the database resides.


G.2.10 GET_YEAR Function

This function returns the year in Oracle YYYY (year) format (0001–9999); returns a NUMBER value. Useful for rule expressions based on time data.

Syntax

GET_YEAR(
  p_date DATE DEFAULT SYSDATE);

Parameter

Table G-11 GET_YEAR Parameter

Parameter Description

p_date

Date in YYYY format, for example, 1984.

If you do not specify a date, Oracle Database Vault uses the SYSDATE function to retrieve the current date and time set for the operating system on which the database resides.


G.2.11 GET_SQL_TEXT Function

This function concatenates the elements of ora_name_list_t into a single VARCHAR2 value, and then returns a VARCHAR2 value.

Syntax

GET_SQL_TEXT(
  p_sql_text ora_name_list_t); 

Parameters

Table G-12 GET_SQL_TEXT Parameter

Parameter Description

p_sql_text

Table of VARCHAR2 strings representing SQL text, for example, SELECT, DROP TABLE, and so on.


G.2.12 IN_CALL_STACK Function

This function checks for a string in the PL/SQL call stack, and then returns a BOOLEAN value. IN_CALL_STACK returns TRUE if the string is in the call stack.

Syntax

IN_CALL_STACK(
  p_search_term VARCHAR2); 

Parameter

Table G-13 IN_CALL_STACK Parameter

Parameter Description

p_search_term

String to search for


G.2.13 IS_ALPHA Function

This function checks whether the character is alphabetic, and then returns a BOOLEAN value. IS_ALPHA returns TRUE if the character is alphabetic.

Syntax

IS_ALPHA(
  c VARCHAR2); 

Parameter

Table G-14 IS_ALPHA Parameter

Parameter Description

c

String with one character


G.2.14 IS_DIGIT Function

This function checks whether the character is numeric, and then returns a BOOLEAN value. IS_DIGIT returns TRUE if the character is a digit.

Syntax

IS_DIGIT(
  c VARCHAR2);

Parameter

Table G-15 IS_DIGIT Parameter

Parameter Description

c

String with one character


G.2.15 IS_DVSYS_OWNER Function

This function determines whether a user is authorized to manage the Oracle Database Vault configuration, and then returns a BOOLEAN value. IS_DVSYS_OWNER returns TRUE if the user is authorized.

Syntax

IS_DVSYS_OWNER(
  p_user VARCHAR2 DEFAULT USER);

Parameter

Table G-16 IS_DVSYS_OWNER Parameter

Parameter Description

p_user

User to check.

To find existing users, use the following views:


G.2.16 IS_OLS_INSTALLED Function

This function returns an indicator as to whether or not Oracle Label Security is installed, and then returns a TRUE or FALSE BOOLEAN value. If Oracle Label Security is installed, IS_OLS_INSTALLED returns TRUE.

Syntax

IS_OLS_INSTALLED()

Parameters

None.

G.2.17 IS_OLS_INSTALLED_VARCHAR Function

This function returns an indicator as to whether or not Oracle Label Security is installed, and then returns a Y or N VARCHAR2 value. If Oracle Label Security is installed, IS_OLS_INSTALLED_VARCHAR returns Y.

Syntax

IS_OLS_INSTALLED_VARCHAR()

Parameters

None.

G.2.18 GET_MESSAGE_LABEL Function

This function looks up an Oracle RDBMS error message, and then returns a VARCHAR2 value.

Syntax

GET_MESSAGE_LABEL(
  p_message_code VARCHAR2); 

Parameters

Table G-17 GET_MESSAGE_LABEL Parameter

Parameter Description

p_message

Message code.

See Oracle Database Error Messages for a listing of error messages.

p_parameter1

Value to substitute for %1

p_parameter2

Value to substitute for %2

p_parameter3

Value to substitute for %3

p_parameter4

Value to substitute for %4

p_parameter5

Value to substitute for %5

p_parameter6

Value to substitute for %6


G.2.19 GET_MESSAGE_LABEL Function

This function looks up an Oracle RDBMS error message, and then returns a NUMBER value.

Syntax

GET_MESSAGE_LABEL(
  p_message_code NUMBER); 

Parameters

Table G-18 GET_MESSAGE_LABEL Parameter

Parameter Description

p_message

Message code.

See Oracle Database Error Messages for a listing of error messages.

p_parameter1

Value to substitute for %1

p_parameter2

Value to substitute for %2

p_parameter3

Value to substitute for %3

p_parameter4

Value to substitute for %4

p_parameter5

Value to substitute for %5

p_parameter6

Value to substitute for %6


G.2.20 RAISE_UNAUTHORIZED_OPERATION Function

This function generates an ORA-20920 (Unauthorized Operation) error for unauthorized users.

Syntax

RAISE_UNAUTHORIZED_OPERATION(
  p_user VARCHAR2 DEFAULT USER); 

Parameter

Table G-19 RAISE_UNAUTHORIZED_OPERATION Parameter

Parameter Description

p_user

User performing the operation.

To find existing users, use the following views:


G.2.21 TO_ORACLE_IDENTIFIER Function

This function turns string into a legal Oracle identifier, and then returns a VARCHAR2 value.

Syntax

TO_ORACLE_IDENTIFIER(
  id VARCHAR2);

Parameter

Table G-20 TO_ORACLE_IDENTIFIER Parameter

Parameter Description

id

Illegal identifier


G.2.22 USER_HAS_OBJECT_PRIVILEGE Function

This function checks whether a user or role may access an object through an object privilege grant, and then returns a BOOLEAN value. If the user or role has object privileges, then USER_HAS_OBJECT_PRIVILEGE returns TRUE.

Syntax

USER_HAS_OBJECT_PRIVILEGE(
  p_user          VARCHAR2, 
  p_object_owner  VARCHAR2, 
  p_object_name   VARCHAR2, 
  p_privilege     VARCHAR2); 

Parameters

Table G-21 USER_HAS_OBJECT_PRIVILEGE Parameters

Parameter Description

p_user

User or role to check.

To find existing users, use the following views:

p_object_owner

Object owner.

To find the available users, use the DBA_USERS view, described in Oracle Database Reference.

To find the authorization of a particular user, use the DVA_DV_REALM_AUTH view, described in "Oracle Database Vault Public Views".

p_object_name

Object name.

To find the available objects, use the ALL_OBJECTS view, described in Oracle Database Reference.

To find objects that are secured by existing realms, use the DBA_DV_REALM_OBJECT view, described in "Oracle Database Vault Public Views".

p_privilege

Object privilege, for example, SELECT, UPDATE, INSERT, and so on.

To find privileges for a database account excluding PUBLIC privileges, use the DBA_DV_USER_PRIVS view. To find all privileges for a database account, use DBA_DV_USER_PRIVS_ALL. Both are described in "Oracle Database Vault Public Views".


G.2.23 USER_HAS_ROLE Function

This function checks whether a user has a role privilege, directly or indirectly (through another role), and then returns a BOOLEAN value. If the user has a role privilege, then USER_HAS_ROLE returns TRUE.

Syntax

USER_HAS_ROLE(
  p_role VARCHAR2, 
  p_user VARCHAR2 DEFAULT USER);

Parameters

Table G-22 USER_HAS_ROLE Parameters

Parameter Description

p_role

Role privilege to check.

To find existing roles, use the following views:

p_user

User to check.

To find existing users, use the following views:


G.2.24 USER_HAS_ROLE_VARCHAR Function

This function checks whether a user has a role privilege, directly or indirectly (through another role), and then returns a VARCHAR2 value. If the user has the role privilege specified, then USER_HAS_ROLE_VARCHAR returns Y.

Syntax

USER_HAS_ROLE_VARCHAR(
  p_role VARCHAR2, 
  p_user VARCHAR2 DEFAULT USER);

Parameters

Table G-23 USER_HAS_ROLE_VARCHAR Parameters

Parameter Description

p_role

Role to check.

To find existing roles, use the following views:

p_user

User to check.

To find existing users, use the following views:


G.2.25 USER_HAS_SYSTEM_PRIVILEGE Function

This function checks whether a user has a system privilege, directly or indirectly (through a role), and then returns a BOOLEAN value. If the user has the system privilege specified, then USER_HAS_SYSTEM_PRIVILEGE returns TRUE.

Syntax

USER_HAS_SYSTEM_PRIVILEGE(
  p_privilege  VARCHAR2, 
  p_user       VARCHAR2 DEFAULT USER);

Parameters

Table G-24 USER_HAS_SYSTEM_PRIVILEGE Parameters

Parameter Description

p_privilege

System privilege to check for.

To find privileges for a database account excluding PUBLIC privileges, use the DBA_DV_USER_PRIVS view. To find all privileges for a database account, use DBA_DV_USER_PRIVS_ALL. Both are described in "Oracle Database Vault Public Views".

p_user

User to check.

To find existing users, use the following views: