Application of Oracle Mandatory Access Control Model

The following articles mainly introduce the comparison policies of the Oracle mandatory access control model and the actual application. If you are interested in the actual operations, the following articles will provide you with relevant knowledge. I hope you will gain some benefits.

(1) user security mark

You can specify the access permission when you grant a security flag to a user.

 
 

  
  
GRANT SECURITY LABEL DataAccess.ManagerLabel TO USER JOE FOR READ ACCESS; 
 
 

Three ACCESS permissions are available: read access, write access, and all access. If the read/write security tag exists at the same time, the following conditions must be met: the value of the array-type component, the two security tags must be the same; the value of the Set-type component, the write access permission security tag must be included in the read Oracle mandatory access permission security tag; the value of the tree type component, the write access permission security tag must be the same as the Read access permission security tag or its child nodes.

One user can be granted multiple security tags, but only one read permission security tag and one write Oracle mandatory access permission security tag can be granted to the tags in a security policy.

(2) Row-level security mark

Use security tags to protect tables at the row level.

The following is a reference clip:

 
 

  
  
CREATE TABLE T1 (   
  
  
A DB2SECURITYLABEL,   
  
  
B INTEGER,   
  
  
C CHAR(5))   
  
  
SECURITY POLICY DataAccess  
 
 

DB2SECURITYLABEL is the type of label column, which is actually processed as VARBINARY (128) internally ). The hidden flag column is not null with default, and the DEFAULT value is the user's write security tag.

(3) column-level security tag

Use security tags to protect tables at the column level.

The following is a reference clip:

 
 

  
  
CREATE TABLE T1 (   
  
  
A CHAR(8) SECURED WITH ManagerLabel,   
  
  
B INTEGER,   
  
  
C CHAR(5))   
  
  
SECURITY POLICY DataAccess  
 
 

(4) Table-level security tag

Label Security labels are actually implemented using column-level security labels.

The following is a reference clip:

 
 

  
  
CREATE TABLE T1 (   
  
  
A CHAR(8) SECURED WITH ManagerLabel,   
  
  
B INTEGER SECURED WITH ManagerLabel,   
  
  
C CHAR(5) SECURED WITH ManagerLabel)   
  
  
SECURITY POLICY DataAccess  
 
 

Set the same security tag on all columns that Oracle enforces, and associate a table as a whole with a security tag, which saves the time overhead for comparing row-level security tags and storage space overhead.

Note: A table can only have one security policy, and only one security policy tag can be used for one column. A table can only have one row-level tag column.

Article by: http://www.programbbs.com/doc/class10-1.htm