Oracle's security tag is not a bug

ORACLE provides the security tag function, that is, OLS, also known as force access control. The model is built on the BLP Security Model and expanded.

The BLP model has the security level and scope, that is, you can set the security level and scope of the subject and object to control the data flow, that is, the downward read and write rules. That is, the user can read data lower than the user's security level, and write data higher than the user's security level, of course, there is a range of conventions, which will not be introduced here ).

ORACLE expands the BLP model. You can set multiple security levels through the following interfaces:

 
 

  
  
SA_USER_ADMIN.SET_LEVELS          
  
  
Syntax:      
  
  
PROCEDURE SET_LEVELS (policy_name IN VARCHAR2,         
  
  
user_name          
  
  
IN VARCHAR2,         
  
  
max_level          
  
  
IN VARCHAR2,         
  
  
min_level          
  
  
IN VARCHAR2 DEFAULT NULL,         
  
  
def_level          
  
  
IN VARCHAR2 DEFAULT NULL,         
  
  
row_level          
  
  
IN VARCHAR2 DEFAULT NULL);          
  
  
Parameter                                     Meaning      
  
  
policy_name                                 Specifies the policy          
  
  
user_name                                 Specifies the user name           
  
  
max_level                                 The highest level for read and write access      
  
  
min_level                                 The lowest level for write access　def_level                                 Specifies the default level (equal to or   
  
  
                                          greater than the minimum level, and equal                                             　                                  to or less than the maximum level)          
  
  
row_level                                 Specifies the row level (equal to or greater                                                                              than the minimum level, and equal to or     
 
 

We can see that user tags can specify the maximum, minimum, default, and row-level security levels. These security levels are constrained.

 
 

  
  
min_level<=max_levelmin_level<=def_level<=max_levelmin_level<=row_level<=def_level　 
 
 

If this rule is violated, the execution of this function will fail. After learning so much about it, we can use LBACSYS to log on and execute the following statement.

 
 

  
  
-- Create policy P1 and add a security level for the policy. A greater value indicates a higher security level.
  
  
-- L1 <L2 <L3 <L4
  
  
EXEC sa_sysdba.create_policy ('p1', 'label _ col ');
  
  
EXEC sa_components.create_level ('p1', 10, 'l1', 'l1 ');
  
  
EXEC sa_components.create_level ('p1', 20, 'l2', 'l2 ');
  
  
EXEC sa_components.create_level ('p1', 30, 'l3 ', 'l3 ');
  
  
EXEC sa_components.create_level ('p1', 40, 'l4 ', 'l4 ');
  
  
-- Set User tags for user SYSMAN
  
  
EXEC sa_user_admin.set_levels ('p1', 'sysmanc', 'l2', 'l1', 'l2', 'l2 ');
 
 

According to the above introduction, the four security levels set here meet the requirements. You can view User tags in the DBA_SA_USER_LABELS view.

 
 

  
  
SQL> SELECT USER_NAME, LABELS FROM DBA_SA_USER_LABELS;  
  
  
USER_NAME      
  
  
--------------------------------------------------------------------------------      
  
  
LABELS      
  
  
--------------------------------------------------------------------------------      
  
  
SYSMAN      
  
  
MAX READ LABEL='L2',MAX WRITE LABEL='L2',MIN WRITE LABEL='L1',DEFAULT READ LABEL      
  
  
='L2',DEFAULT WRITE LABEL='L2',DEFAULT ROW LABEL='L2' 
 
 

You can see that min write label = L1

At the same time, ORACLE provides a system function to change the tag value:

 
 

  
  
Syntax:      
  
  
PROCEDURE ALTER_LABEL (         
  
  
   policy_name       IN VARCHAR2,         
  
  
   label_tag         IN INTEGER,         
  
  
   new_label_value   IN VARCHAR2 DEFAULT NULL,         
  
  
   new_data_label    IN BOOLEAN  DEFAULT NULL);      
  
  
PROCEDURE ALTER_LABEL (  
  
  
   policy_name       IN VARCHAR2,         
  
  
   label_value       IN VARCHAR2,         
  
  
   new_label_value   IN VARCHAR2 DEFAULT NULL,         
  
  
   new_data_label    IN BOOLEAN  DEFAULT NULL);      
  
  
Table 6–18 Parameters for SA_LABEL_ADMIN.ALTER_LABEL      
  
  
   Parameter Name                         Parameter Description   
  
  
   policy_name                     Specifies the name of an existing policy       
  
  
   label_tag                         　Identifies the integer tag assigned to the label                                     　                                     to be altered       
  
  
   label_value                         Identifies the existing character string                                                                                   representation of the label to be altered       
  
  
   new_label_value                 Specifies the new character string                                                                                   representation of the label value. If NULL, the                                     　                                       existing value is not changed.  
 
 

In this case, the L1 mark is rewritten.

 
 

  
  
EXEC sa_label_admin.alter_label('P1', 'L1', 'L4', TRUE); 
 
 

After the operation is successful, we can view the user tag table and find the following:

 
 

  
  
SQL> SELECT USER_NAME, LABELS FROM DBA_SA_USER_LABELS;  
  
  
USER_NAME  
  
  
--------------------------------------------------------------------------------  
  
  
LABELS  
  
  
--------------------------------------------------------------------------------  
  
  
SYSMAN  
  
  
MAX READ LABEL='L2',MAX WRITE LABEL='L2',MIN WRITE LABEL='L4',DEFAULT READ LABEL  
  
  
='L2',DEFAULT WRITE LABEL='L2',DEFAULT ROW LABEL='L2' 
 
 

It can be seen that the min write label is changed to L4, And the other LABEL is L2. At this time, the user LABEL is invalid. In this case, when performing the corresponding operation, many operations are forbidden, such as updating a marked table, because the user mark will always be a constant false value during access judgment, but the system will not crash at this time, A little disappointed ..), the above experiment version is 11.1.0.6.0