动手操作oracle细粒度访问控制（FGAC)一则
环境：
sys@ORCL> select * from v$version where rownum=1; BANNER ---------------------------------------------------------------- Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod sys@ORCL> !uname -a Linux localhost.localdomain 2.6.18-308.el5xen #1 SMP Fri Jan 27 17:59:00 EST 2012 i686 i686 i386 GNU/Linux
实验过程如下：
scott@ORCL> create table tvpd (name varchar2(20),salary number(8,2),department_id number(5));
Table created.
scott@ORCL> insert into tvpd values('张三',5000,10);
1 row created.
scott@ORCL> insert into tvpd values('李四',250,20);
1 row created.
scott@ORCL> commit;
Commit complete.
sys@ORCL> grant connect to zhangsan identified by zhangsan;
Grant succeeded.
sys@ORCL> grant select on scott.tvpd to zhangsan;
Grant succeeded.
sys@ORCL> grant connect to lisi identified by lisi;
Grant succeeded.
sys@ORCL> grant select on scott.tvpd to lisi;
Grant succeeded.
sys@ORCL> conn zhangsan/zhangsan
Connected.
zhangsan@ORCL> select * from scott.tvpd;
NAME SALARY DEPARTMENT_ID
-------------------- ---------- -------------
张三 5000 10
李四 250 20
zhangsan@ORCL> conn scott/tiger
Connected.
scott@ORCL> create or replace function func_vpd
(owner varchar2,objname varchar2)
return varchar2
is
v_where_clause varchar2(2000);
begin
v_where_clause :='name=initcap(sys_context(''userenv'',''session_user''))';
return v_where_clause;
end; 2 3 4 5 6 7 8 9
10 /
Function created.
scott@ORCL> conn / as sysdba
Connected.
sys@ORCL> select * from dba_policies where object_owner='SCOTT';
no rows selected
sys@ORCL> BEGIN
dbms_rls.add_policy(object_schema => 'SCOTT',
object_name => 'TVPD',
policy_name => 'scott_policy123',
function_schema =>'SCOTT',
policy_function => 'func_vpd',
statement_types =>'select',
sec_relevant_cols=>'salary');
END; 2 3 4 5 6 7 8 9
10 /
PL/SQL procedure successfully completed.
sys@ORCL> select * from dba_policies where object_owner='SCOTT';
OBJECT_OWNER OBJECT_NAME POLICY_GROUP
------------------------------ ------------------------------ ------------------------------
POLICY_NAME PF_OWNER PACKAGE
------------------------------ ------------------------------ ------------------------------
FUNCTION SEL INS UPD DEL IDX CHK ENA STA POLICY_TYPE LON
------------------------------ --- --- --- --- --- --- --- --- ------------------------ ---
SCOTT TVPD SYS_DEFAULT
SCOTT_POLICY123 SCOTT
FUNC_VPD YES NO NO NO NO NO YES NO DYNAMIC NO
scott@ORCL> conn zhangsan/zhangsan
Connected.
zhangsan@ORCL> select * from scott.tvpd;
no rows selected
zhangsan@ORCL> select name from scott.tvpd;
NAME
--------------------
张三
李四
在本测试中，我们只是对列salary作精细化控制，如果不查工资还是可以全部看到的，正如上面所示。
但是请注意，sys仍然不受影响，因为他有个权限叫“exempt access policy”，这个的性质和sysdba一样。
zhangsan@ORCL> conn / as sysdba Connected. sys@ORCL> grant exempt access policy to zhangsan; Grant succeeded. sys@ORCL> conn zhangsan/zhangsan Connected. zhangsan@ORCL> select * from scott.tvpd; NAME SALARY DEPARTMENT_ID -------------------- ---------- ------------- 张三 5000 10 李四 250 20
同时，受策略保护的表若被drop是不进recyclebin，也就无法用flashback ... to before drop。
zhangsan@ORCL> conn scott/tiger Connected. scott@ORCL> show recyclebin scott@ORCL> drop table tvpd; Table dropped. scott@ORCL> show recyclebin scott@ORCL> flashback table tvpd to before drop; flashback table tvpd to before drop * ERROR at line 1: ORA-38305: object not in RECYCLE BIN