12 Using the DVSYS.DBMS_MACADM Package

realm_name

Realm name.

To find the existing realms in the current database instance, query the DVSYS.DBA_DV_REALM view, described in "DBA_DV_REALM View".

grantee

User or role name to authorize as an owner or a participant.

To find the existing users and roles in the current database instance, query the DBA_USERS and DBA_ROLES views, described in Oracle Database Reference.

To find the authorization of a particular user or role, query the DVA_DV_REALM_AUTH view, described in "DBA_DV_REALM_AUTH View".

To find existing secure application roles used in privilege management, query the DVSYS.DBA_DV_ROLE view. Both are described in "Oracle Database Vault Data Dictionary Views".

rule_set_name

Optional. Rule set to check before authorizing. If the rule set evaluates to TRUE, then the authorization is allowed.

To find the available rule sets, query the DVSYS.DBA_DV_RULE_SET view, described in "DBA_DV_RULE_SET View".

auth_options

Optional. Specify one of the following options to authorize the realm:

• 0: Participant. This account or role provides system or direct privileges to access, manipulate, and create objects protected by the realm, provided these rights have been granted using the standard Oracle Database privilege grant process.

• 1: Owner. This account or role has the same privileges as the realm participant, plus the authorization to grant or revoke realm-secured database roles. A realm can have multiple owners.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_REALM_AUTH_PARTICIPANT

• G_REALM_AUTH_OWNER

See "Defining Realm Authorization" for more information on participants and owners.

realm_name

Realm name.

To find the existing realms in the current database instance, query the DVSYS.DBA_DV_REALM view, described in "DBA_DV_REALM View"

object_owner

The owner of the object that is being added to the realm. If you add a role to a realm, the object owner of the role is shown as % (for all), because roles do not have owners.

To find the available users, query the DBA_USERS view, described in Oracle Database Reference.

To find the authorization of a particular user or role, query the DVA_DV_REALM_AUTH view, described in "DBA_DV_REALM_AUTH View".

object_name

Object name. (The wildcard % is allowed. See "Object Name" under "Creating Realm-Secured Objects" for exceptions to the wildcard %.) You can also use the DVSYS.DBMS_MACUTL G_ALL_OBJECT constant.

To find the available objects, query the ALL_OBJECTS view, described in Oracle Database Reference.

To find objects that are secured by existing realms, query the DVSYS.DBA_DV_REALM_OBJECT view, described in "DBA_DV_REALM_OBJECT View".

object_type

Object type, such as TABLE, INDEX, or ROLE. (The wildcard % is allowed. See "Object Types" under "Creating Realm-Secured Objects" for exceptions to the wildcard %.)

You can also use the DVSYS.DBMS_MACUTL G_ALL_OBJECT constant.

realm_name

Realm name, up to 90 characters in mixed-case.

To find the existing realms in the current database instance, query the DVSYS.DBA_DV_REALM view, described in "DBA_DV_REALM View".

description

Description of the purpose of the realm, up to 1024 characters in mixed-case.

enabled

Y (yes) enables realm checking; N (no) disables it. The default is Y.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_YES

• G_NO

audit_options

Specify one of the following options to audit the realm:

• 0: Disables auditing for the realm (default)

• 1: Creates an audit record when a realm violation occurs (for example, when an unauthorized user tries to modify an object that is protected by the realm)

• 2: Creates an audit record for authorized activities on objects protected by the realm

• 3: Creates an audit record for both authorized and unauthorized activities on objects protected by the realm

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_REALM_AUDIT_OFF (default)

• G_REALM_AUDIT_SUCCESS

• G_REALM_AUDIT_FAIL

• G_REALM_AUDIT_FAIL + G_REALM_AUDIT_SUCCESS

realm_name

Realm name.

To find the existing realms in the current database instance, query the DVSYS.DBA_DV_REALM view, described in "DBA_DV_REALM View"

grantee

User or role name.

To find the authorization of a particular user or role, query the DVA_DV_REALM_AUTH view, described in "DBA_DV_REALM_AUTH View".

realm_name

Realm name.

To find the existing realms in the current database instance, query the DVSYS.DBA_DV_REALM view, described in "DBA_DV_REALM View"

object_owner

The owner of the object that was added to the realm.

To find the available users, query the DBA_USERS view, described in Oracle Database Reference.

object_name

Object name. (The wildcard % is allowed. See "Object Name" under "Creating Realm-Secured Objects" for exceptions to the wildcard %.) You can also use the DVSYS.DBMS_MACUTL G_ALL_OBJECT constant.

To find objects that are secured by existing realms, query the DVSYS.DBA_DV_REALM_OBJECT view, described in "DBA_DV_REALM_OBJECT View".

object_type

Object type, such as TABLE, INDEX, or ROLE. (The wildcard % is allowed. See "Object Types" under "Creating Realm-Secured Objects" for exceptions to the wildcard %.)

You can also use the DVSYS.DBMS_MACUTL G_ALL_OBJECT constant.

realm_name

Realm name.

To find the existing realms in the current database instance, query the DVSYS.DBA_DV_REALM view, described in "DBA_DV_REALM View"

realm_name

Realm name.

To find the existing realms in the current database instance, query the DVSYS.DBA_DV_REALM view, described in "DBA_DV_REALM View"

realm_name

Current realm name.

To find the existing realms in the current database instance, query the DVSYS.DBA_DV_REALM view, described in "DBA_DV_REALM View"

new_name

New realm name, up to 90 characters in mixed-case.

realm_name

Realm name.

To find the existing realms in the current database instance, query the DVSYS.DBA_DV_REALM view, described in "DBA_DV_REALM View"

description

Description of the purpose of the realm, up to 1024 characters in mixed-case.

enabled

Y (yes) enables realm checking; N (no) disables it.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_YES

• G_NO

The default for enabled is the previously set value, which you can find by querying the DVSYS.DBA_DV_REALM data dictionary view. (This feature is available with Oracle Database 11g Release 2 (11.2.0.2).)

audit_options

Specify one of the following options to audit the realm:

• 0: Disables auditing for the realm

• 1: Creates an audit record when a realm violation occurs (for example, when an unauthorized user tries to modify an object that is protected by the realm

• 2: Creates an audit record for authorized activities on objects protected by the realm.

• 3: Creates an audit record for both authorized and unauthorized activities on objects protected by the realm

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_REALM_AUDIT_OFF

• G_REALM_AUDIT_SUCCESS

• G_REALM_AUDIT_FAIL

• G_REALM_AUDIT_FAIL + G_REALM_AUDIT_SUCCESS

The default for audit_options is the previously set value, which you can find by querying the DVSYS.DBA_DV_REALM data dictionary view.

realm_name

Realm name.

To find the existing realms in the current database instance, query the DVSYS.DBA_DV_REALM view, described in "DBA_DV_REALM View".

grantee

User or role name.

To find the available users and roles, query the DBA_USERS and DBA_ROLES views, described in Oracle Database Reference.

To find the authorization of a particular user or role, query the DVA_DV_REALM_AUTH view, described in DBA_DV_REALM_AUTH View.

To find existing secure application roles used in privilege management, query the DVSYS.DBA_DV_ROLE view, described in "DBA_DV_ROLE View".

rule_set_name

Optional Rule set to check before authorizing. If the rule set evaluates to TRUE, then the authorization is allowed.

To find the available rule sets, query the DVSYS.DBA_DV_RULE_SET view. To find rules that are associated with the rule sets, query the DBA_DB_RULE_SET_RULE view. Both are described in "Oracle Database Vault Data Dictionary Views".

auth_options

Optional. Specify one of the following options to authorize the realm:

• 0: Participant. This account or role provides system or direct privileges to access, manipulate, and create objects protected by the realm, provided these rights have been granted using the standard Oracle Database privilege grant process.

• 1: Owner. This account or role has the same privileges as the realm participant, plus the authorization to grant or revoke realm-secured database roles. A realm can have multiple owners.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_REALM_AUTH_PARTICIPANT

• G_REALM_AUTH_OWNER

The default for auth_options value is the previously set value, which you can find by querying the DVSYS.DBA_DV_REALM_AUTH data dictionary view.

rule_set_name

Rule set name.

To find existing rule sets in the current database instance, query the DVSYS.DBA_DV_RULE_SET view, described in "DBA_DV_RULE_SET View".

rule_name

Rule to add to the rule set.

To find existing rules, query the DVSYS.DBA_DV_RULE view, described in "DBA_DV_RULE View".

To find rules that have been associated with rule sets, use DVSYS.DBA_DV_RULE_SET_RULE, described in "DBA_DV_RULE View".

rule_order

Does not apply to this release, but you must include a value for the ADD_RULE_TO_RULE_SET procedure to work. Enter 1.

enabled

Optional. Determines whether the rule should be checked when the rule set is evaluated. Possible values are:

• Y (yes; default). Enables the rule to be checked during the rule set evaluation.

• N (no). Prevents the rule from being checked during the rule set evaluation.

You can also enter the following DVSYS.DBMS_MACUTL constants:

• G_YES (default)

• G_NO

See Table 14-1 for more information.

rule_name

Rule name, up to 90 characters in mixed-case. Spaces are allowed.

To find existing rules in the current database instance, query the DVSYS.DBA_DV_RULE view, described in "DBA_DV_RULE View".

To find rules that have been associated with rule sets, query DVSYS.DBA_DV_RULE_SET_RULE, described in "DBA_DV_RULE_SET_RULE View".

rule_expr

PL/SQL BOOLEAN expression.

If the expression contains quotation marks, do not use double quotation marks. Instead, use two single quotation marks. Enclose the entire expression within single quotation marks. For example:

'TO_CHAR(SYSDATE,''HH24'') = ''12'''

See "Creating a New Rule" for more information on rule expressions.

rule_set_name

Rule set name, up to 90 characters in mixed-case. Spaces are allowed.

To find existing rule sets in the current database instance, query the DVSYS.DBA_DV_RULE_SET view, described in "DBA_DV_RULE_SET View".

description

Description of the purpose of the rule set, up to 1024 characters in mixed-case.

enabled

Y (yes) enables the rule set; N (no) disables it. The default is Y.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_YES

• G_NO

eval_options

If you plan to assign multiple rules to the rule set, enter one of the following settings:

• 1: All rules in the rule set must evaluate to true for the rule set itself to evaluate to true (default).

• 2: At least one rule in the rule set must evaluate to true for the rule set itself to evaluate to true.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_RULESET_EVAL_ALL (default)

• G_RULESET_EVAL_ANY

audit_options

Select one of the following settings:

• 0: Disables auditing for the rule set (default)

• 1: Creates an audit record when a rule set violation occurs

• 2: Creates an audit record for a successful rule set evaluation

• 3: Creates an audit record for both successful and failed rule set evaluations

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_RULESET_AUDIT_OFF (default)

• G_RULESET_AUDIT_SUCCESS

• G_RULESET_AUDIT_FAIL

• G_RULESET_AUDIT_FAIL + G_RULESET_AUDIT_SUCCESS

See "Audit Options" for more information.

fail_options

Options for reporting factor errors:

• 1: Shows an error message (default)

• 2: Does not show an error message

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_RULESET_FAIL_SHOW (default)

• G_RULESET_FAIL_SILENT

See "Error Handling Options" for more information.

fail_message

Enter an error message for failure, up to 80 characters in mixed-case, to associate with the fail code you specify for fail_code.

fail_code

Enter a number in the range of -20000 to -20999 or 20000 to 20999 to associate with the fail_message parameter.

handler_options

Select one of the following settings:

• 0: Disables error handling (default)

• POWER(2,0): Calls handler on rule set failure

• POWER(2,1): Calls handler on rule set success

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_RULESET_HANDLER_OFF (default)

• G_RULESET_HANDLER_FAIL

• G_RULESET_HANDLER_SUCCESS

See "Error Handling Options" for more information.

handler

Name of the PL/SQL function or procedure that defines the custom event handler logic.

See "Error Handling Options" for more information.

is_static

Optional. Determines how often a rule set is evaluated when it is accessed. The default is FALSE.

• TRUE: The rule set is evaluated once during the user session. After that, the value is re-used.

• FALSE: The rule set evaluated every time.

rule_name

Rule name.

To find existing rules in the current database instance, query the DVSYS.DBA_DV_RULE view, described in "DBA_DV_RULE View".

To find rules that have been associated with rule sets, query DVSYS.DBA_DV_RULE_SET_RULE, described in "DBA_DV_RULE_SET_RULE View".

rule_set_name

Rule set name.

To find existing rule sets in the current database instance, query the DVSYS.DBA_DV_RULE_SET view, described in "DBA_DV_RULE_SET View".

rule_name

Rule to remove from the rule set.

To find existing rules in the current database instance, query the DVSYS.DBA_DV_RULE view, described in "DBA_DV_RULE View".

To find rules that have been associated with rule sets, query DVSYS.DBA_DV_RULE_SET_RULE, described in "DBA_DV_RULE_SET_RULE View".

rule_set_name

Rule set name.

To find existing rule sets in the current database instance, query the DVSYS.DBA_DV_RULE_SET view, described in "DBA_DV_RULE_SET View".

rule_name

Current rule name.

To find existing rules in the current database instance, query the DVSYS.DBA_DV_RULE view, described in "DBA_DV_RULE View".

To find rules that have been associated with rule sets, query DVSYS.DBA_DV_RULE_SET_RULE, described in "DBA_DV_RULE_SET_RULE View".

new_name

New rule name, up to 90 characters in mixed-case.

rule_set_name

Current rule set name.

To find existing rule sets in the current database instance, query the DVSYS.DBA_DV_RULE_SET view, described in "DBA_DV_RULE_SET View".

new_name

New rule set name, up to 90 characters in mixed-case. Spaces are allowed.

rule_name

Rule name.

To find existing rules in the current database instance, query the DVSYS.DBA_DV_RULE view, described in "DBA_DV_RULE View".

To find rules that have been associated with rule sets, query DVSYS.DBA_DV_RULE_SET_RULE, described in "DBA_DV_RULE_SET_RULE View".

rule_expr

PL/SQL BOOLEAN expression.

If the expression contains quotation marks, do not use double quotation marks. Instead, use two single quotation marks. Enclose the entire expression within single quotation marks. For example:

'TO_CHAR(SYSDATE,''HH24'') = ''12'''

See "Creating a New Rule" for more information on rule expressions.

To find existing rule expressions, query the DVSYS.DBA_DV_RULE view.

rule_set_name

Rule set name.

To find existing rule sets in the current database instance, query the DVSYS.DBA_DV_RULE_SET view, described in "DBA_DV_RULE_SET View".

description

Description of the purpose of the rule set, up to 1024 characters in mixed-case.

enabled

Y (yes) enables rule set checking; N (no) disables it.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_YES

• G_NO

The default for the enabled setting is the previously set value, which you can find by querying the DVSYS.DBA_DV_RULE_SET data dictionary view.

eval_options

If you plan to assign multiple rules to the rule set, enter one of the following settings:

• 1: All rules in the rule set must evaluate to true for the rule set itself to evaluate to true.

• 2: At least one rule in the rule set must evaluate to true for the rule set itself to evaluate to true.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_RULESET_EVAL_ALL

• G_RULESET_EVAL_ANY

The default for eval_options is the previously set value, which you can find by querying the DVSYS.DBA_DV_RULE_SET data dictionary view.

audit_options

Select one of the following settings:

• 0: Disables auditing for the rule set

• 1: Creates an audit record when a rule set violation occurs

• 2: Creates an audit record for a successful rule set evaluation

• 3: Creates an audit record for both successful and failed rule set evaluations

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_RULESET_AUDIT_OFF

• G_RULESET_AUDIT_FAIL

• G_RULESET_AUDIT_SUCCESS

• G_RULESET_AUDIT_FAIL + G_RULESET_AUDIT_SUCCESS

The default for audit_options is the previously set value, which you can find by querying the DVSYS.DBA_DV_RULE_SET data dictionary view.

See "Audit Options" for more information.

fail_options

Options for reporting factor errors:

• 1: Shows an error message.

• 2: Does not show an error message.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_RULESET_FAIL_SHOW

• G_RULESET_FAIL_SILENT

The default for fail_options is the previously set value, which you can find by querying the DVSYS.DBA_DV_RULE_SET data dictionary view.

See "Error Handling Options" for more information.

fail_message

Error message for failure, up to 80 characters in mixed-case, to associate with the fail code you specify for fail_code.

fail_code

Enter a number in the range of -20000 to -20999 or 20000 to 20999 to associate with the fail_message parameter.

handler_options

Select one of the following settings:

• 0: Disables error handling.

• POWER(2,0): Call handler on rule set failure.

• POWER(2,1): Call handler on rule set success.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_RULESET_HANDLER_OFF

• G_RULESET_HANDLER_FAIL

• G_RULESET_HANDLER_SUCCESS

The default for handler_options is the previously set value, which you can find by querying the DVSYS.DBA_DV_RULE_SET data dictionary view.

See "Error Handling Options" for more information.

handler

Name of the PL/SQL function or procedure that defines the custom event handler logic.

See "Error Handling Options" for more information.

is_static

Optional. Determines how often a rule set is evaluated when it is accessed by a SQL statement.

• TRUE: The rule set is evaluated once during the user session. After that, the value is re-used.

• FALSE: The rule set evaluated each time a SQL statement accesses it (default).

command

SQL statement to protect.

See also the following:

• "DBA_DV_COMMAND_RULE View" for a listing of existing command rules

• "SQL Statements That Can Be Protected by Command Rules" for a listing of available SQL statements that you can use

• Oracle Database SQL Language Reference for more information about SQL statements

rule_set_name

Name of rule set to associate with this command rule.

To find existing rule sets in the current database instance, query the DVSYS.DBA_DV_RULE_SET view, described in "DBA_DV_RULE_SET View".

object_owner

Database schema to which this command rule will apply. The wildcard % is allowed, except for the SELECT, INSERT, UPDATE, DELETE, and EXECUTE statements.

To find the available users, query the DBA_USERS view, described in Oracle Database Reference.

See also "Object Owner" in "Creating and Editing a Command Rule" for more information.

object_name

Object name. (The wildcard % is allowed. See "Object Name" in "Creating and Editing a Command Rule" for more information about objects protected by command rules.)

To find the available objects, query the ALL_OBJECTS view, described in Oracle Database Reference.

enabled

Y (yes) enables the command rule; N (no) disables it. The default is Y.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_YES

• G_NO

command

SQL statement the command rule protects.

To find available command rules, query the DVSYS.DBA_DV_COMMAND_RULE view, described in "DBA_DV_COMMAND_RULE View"

object_owner

Database schema to which this command rule applies.

To find the available users in the current database instance, query the DBA_USERS view, described in Oracle Database Reference.

See also "Object Owner" in "Creating and Editing a Command Rule" for more information.

object_name

Object name. (The wildcard % is allowed. See "Object Name" in "Creating and Editing a Command Rule" for more information about objects protected by command rules.)

To find the available objects, query the ALL_OBJECTS view, described in Oracle Database Reference.

command

SQL statement to protect.

See also the following:

• "SQL Statements That Can Be Protected by Command Rules" for a listing of available SQL statements that you can use

• "DBA_DV_COMMAND_RULE View" for a listing of existing command rules

• Oracle Database SQL Language Reference for more information about SQL statements

rule_set_name

Name of rule set to associate with this command rule.

To find existing rule sets in the current database instance, query the DVSYS.DBA_DV_RULE_SET view, described in "Oracle Database Vault Data Dictionary Views".

object_owner

Database schema to which this command rule applies.

To find the available users, query the DBA_USERS view, described in Oracle Database Reference. See also "Object Owner" in "Creating and Editing a Command Rule" for more information.

object_name

Object name. (The wildcard % is allowed. See "Object Name" in "Creating and Editing a Command Rule" for more information about objects protected by command rules.)

To find the available objects, query the ALL_OBJECTS view, described in Oracle Database Reference.

enabled

Y (yes) enables the command rule; N (no) disables it.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_YES

• G_NO

The default for enabled is the previously set value, which you can find by querying the DVSYS.DBA_DV_COMMAND_RULE data dictionary view.

parent_factor_name

Parent factor name.

To find existing parent and child factors in the current database instance, query the DVSYS.DBA_DV_FACTOR_LINK view, described in "DBA_DV_FACTOR_LINK View".

child_factor_name

Child factor name.

label_indicator

Indicates that the child factor being linked to the parent factor contributes to the label of the parent factor in an Oracle Label Security integration. Specify either Y (for Yes) or N (for No).

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_YES

• G_NO

To find the Oracle Label Security policies and labels associated with factors, query the following views, described in "Oracle Database Vault Data Dictionary Views":

• DVSYS.DBA_DV_MAC_POLICY: Lists Oracle Label Security policies defined in the current database instance.

• DVSYS.DBA_DV_MAC_POLICY_FACTOR: Lists the factors that are associated with Oracle Label Security policies for the current database instance.

• DVSYS.DBA_DV_POLICY_LABEL: Lists the Oracle Label Security label for each factor identifier in the DVSYS.DBA_DV_IDENTITY view for each policy.

policy_name

Oracle Label Security policy name.

To find the policies defined in the current database instance, query the DVSYS.DBA_DV_MAC_POLICY view, described in "DBA_DV_MAC_POLICY View".

To find factors that are associated with Oracle Label Security policies, query DVSYS.DBA_DV_MAC_POLICY_FACTOR, described in "DBA_DV_MAC_POLICY_FACTOR View".

factor_name

Factor name.

To find existing factors, query the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View".

factor_name

Current factor name.

To find existing factors, query the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View".

value

Value of the identity to update.

To find existing identities for each factor in the current database instance, query the DVSYS.DBA_DV_IDENTITY view, described in "DBA_DV_IDENTITY View".

To find current identity mappings, query the DVSYS.DBA_DV_IDENTITY_MAP view, described in "DBA_DV_IDENTITY_MAP View".

new_factor_name

Name of the factor to associate with the identity, which you can find by querying the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View".

factor_name

Factor name.

To find existing factors, query the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View"

value

Current value associated with the identity.

To find existing identities for each factor in the current database instance, query the DVSYS.DBA_DV_IDENTITY view, described in "DBA_DV_IDENTITY View".

To find current identity mappings, query the DVSYS.DBA_DV_IDENTITY_MAP view, described in "DBA_DV_IDENTITY_MAP View".

new_value

New identity value, up to 1024 characters in mixed-case.

domain_name

Name of the domain to which to add the host.

To find the logical location of the database within the network structure within a distributed database system, run the DVF.F$DATABASE_DOMAIN function, described in "Oracle Database Vault PL/SQL Factor Functions".

domain_host

Oracle Real Application Clusters host name being added to the domain.

To find host name of a database, run the DVF.F$DATABASE_HOSTNAME function, described in "Oracle Database Vault PL/SQL Factor Functions".

policy_name

Oracle Label Security policy name. If you omit the policy name, then the domain is not associated with any policy.

To find the available policies, query the DVSYS.DBA_DV_MAC_POLICY view, described in "DBA_DV_MAC_POLICY View".

domain_label

Name of the domain to which to add the Oracle Label Security policy.

factor_name

Factor name, up to 28 characters in mixed-case, without spaces.

To find existing factors in the current database instance, query the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View".

factor_type_name

Type of the factor, up to 30 characters in mixed-case, without spaces.

To find existing factor types, query the DBA_DV_FACTOR_TYPE view, described in "DBA_DV_FACTOR_TYPE View".

description

Description of the purpose of the factor, up to 1024 characters in mixed-case.

rule_set_name

Rule set name if you want to use a rule set to control when and how a factor identity is set.

To find existing rule sets, query the DVSYS.DBA_DV_RULE_SET view, described in "Oracle Database Vault Data Dictionary Views". See also "Assignment Rule Set" for more information about assigning rule sets to factors.

get_expr

Valid PL/SQL expression that retrieves the identity of a factor. It can use up to 255 characters in mixed-case. See "Retrieval Method" for more information. See also the audit_options parameter.

validate_expr

Name of the procedure to validate the factor. This is a valid PL/SQL expression that returns a Boolean value (TRUE or FALSE) to validate the identity of the factor. See "Validation Method" for more information.

identify_by

Options for determining the identity of a factor, based on the expression set for the get_expr parameter:

• 0: By constant

• 1: By method

• 2: By factor

• 3: By context

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_IDENTIFY_BY_CONSTANT

• G_IDENTIFY_BY_METHOD

• G_IDENTIFY_BY_FACTOR

• G_IDENTIFY_BY_CONTEXT

See "Factor Identification" for more information.

labeled_by

Options for labeling the factor:

• 0: Labels the identities for the factor directly from the labels associated with an Oracle Label Security policy (default)

• 1: Derives the factor identity label from the labels of its child factor identities.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_LABELED_BY_SELF (default)

• G_LABELED_BY_FACTORS

See "Factor Labeling" for more information.

eval_options

Options for evaluating the factor when the user logs on:

• 0: When the database session is created (default)

• 1: Each time the factor is accessed

• 2: On start-up

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_EVAL_ON_SESSION

• G_EVAL_ON_ACCESS

• G_EVAL_ON_STARTUP

See "Evaluation" for more information.

audit_options

Options for auditing the factor if you want to generate a custom Oracle Database Vault audit record.

• 0: Disables auditing.

• POWER(2,0): Always audits.

• POWER(2,1): Audits if get_expr returns an error.

• POWER(2,2): Audits if get_expr is null.

• POWER(2,3): Audits if the validation procedure returns an error.

• POWER(2,4): Audits if the validation procedure is false.

• POWER(2,5): Audits if there is no trust level set.

• POWER(2,6): Audits if the trust level is negative.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_AUDIT_OFF

• G_AUDIT_ALWAYS

• G_AUDIT_ON_GET_ERROR

• G_AUDIT_ON_GET_NULL

• G_AUDIT_ON_VALIDATE_ERROR

• G_AUDIT_ON_VALIDATE_FALSE

• G_AUDIT_ON_TRUST_LEVEL_NULL

• G_AUDIT_ON_TRUST_LEVEL_NEG

See "Audit Options" for more information.

fail_options

Options for reporting factor errors:

• POWER(2,0): Shows an error message (default)

• POWER(2,1): Does not show an error message

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_FAIL_WITH_MESSAGE (default)

• G_FAIL_SILENTLY

See "Error Options" for more information.

name

Factor type name, up to 30 characters in mixed-case, without spaces.

To find existing factor types, query the DVSYS.DBA_DV_FACTOR_TYPE view, described in "DBA_DV_FACTOR_TYPE View".

description

Description of the purpose of the factor type, up to 1024 characters in mixed-case.

factor_name

Factor name.

To find existing factors, query the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View".

value

The actual value of the factor, up to 1024 characters in mixed-case. For example, the identity of an IP_Address factor could be the IP address of 192.0.2.12.

trust_level

Number that indicates the magnitude of trust relative to other identities for the same factor. In general, the higher the trust level number is set, the greater the trust. A trust level of 10 indicates "very trusted." Negative trust levels are not trusted.

See "Creating and Configuring a Factor Identity" for more information about trust levels and label security.

identity_factor_name

Factor the identity map is for.

To find existing factors in the current database instance, query the DVSYS.DBA_DV_FACTOR view, described in "Oracle Database Vault Data Dictionary Views".

identity_factor_value

Value the factor assumes if the identity map evaluates to TRUE.

To find existing factor identities, query the DVSYS.DBA_DV_IDENTITY view, described in "DBA_DV_IDENTITY View".

To find current factor identity mappings, use DVSYS.DBA_DV_IDENTITY_MAP, described in "DBA_DV_IDENTITY_MAP View".

parent_factor_name

The parent factor link to which the map is related.

To find existing parent-child factor mappings, query the DVSYS.DBA_DV_IDENTITY_MAP view, described in "DBA_DV_IDENTITY_MAP View".

child_factor_name

The child factor link to which the map is related.

operation

Relational operator for the identity map (for example, <, >, =, and so on).

operand1

Left operand for the relational operator; refers to the low value you enter.

operand2

Right operand for the relational operator; refers to the high value you enter.

factor_name

Factor name.

To find existing factors in the current database instance, query the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View".

parent_factor_name

Factor name.

To find factors that are used in parent-child mappings in the current database instance, query the DVSYS.DBA_DV_FACTOR_LINK view, described in "DBA_DV_FACTOR_LINK View".

child_factor_name

Factor name.

name

Factor type name.

To find existing factor types, query the DVSYS.DBA_DV_FACTOR_TYPE view, described in "DBA_DV_FACTOR_TYPE View".

factor_name

Factor name.

To find existing factors in the current database instance, query the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View".

value

Identity value associated with the factor.

To find the identities for each factor in the current database instance, query the DVSYS.DBA_DV_IDENTITY view, described in "DBA_DV_IDENTITY View".

identity_factor_name

Factor the identity map is for.

To find existing factors in the current database instance, query the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View".

identity_factor_value

Value the factor assumes if the identity map evaluates to TRUE.

To find existing factor identities, query the DVSYS.DBA_DV_IDENTITY view, described in "DBA_DV_IDENTITY View".

To find current factor identity mappings, query DVSYS.DBA_DV_IDENTITY_MAP, described in "DBA_DV_IDENTITY_MAP View".

parent_factor_name

The parent factor link to which the map is related.

To find existing parent-child factors, query the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR_LINK View".

child_factor_name

The child factor to which the map is related.

operation

Relational operator for the identity map (for example, <, >, =, and so on).

operand1

Left (low value) operand for the relational operator.

operand2

Right (high value) operand for the relational operator.

domain_name

Name of the domain to which the host was added.

To find the domain of a database as specified by the DB_DOMAIN initialization parameter, run the DVF.F$DATABASE_DOMAIN function, described in "Oracle Database Vault PL/SQL Factor Functions".

domain_host

Oracle Real Application Clusters host name being that was added to the domain.

To find the host name for a specified database, run the DVF.F$DATABASE_HOSTNAME function, described in "Oracle Database Vault PL/SQL Factor Functions".

p_parameter

Column name in the SYS.V_$INSTANCE system table

p_parameter

Column name in the SYS.V_$SESSION system table.

factor_name

Current factor name.

To find existing factors in the current database instance, query the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View".

new_factor_name

New factor name, up to 28 characters in mixed-case, without spaces.

old_name

Current factor type name.

To find existing factor types in the current database instance, query the DVSYS.DBA_DV_FACTOR_TYPE view, described in "DBA_DV_FACTOR_TYPE View".

new_name

New factor type name, up to 30 characters in mixed-case, without spaces.

factor_name

Factor name.

To find existing factors in the current database instance, query the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View".

factor_type_name

Factor type name.

To find existing factor types, query the DVSYS.DBA_DV_FACTOR_TYPE view, described in "DBA_DV_FACTOR_TYPE View".

description

Description of the purpose of the factor, up to 1024 characters in mixed-case.

rule_set_name

Name of the rule set used to control when and how a factor identity is set.

To find existing rule sets, query the DVSYS.DBA_DV_RULE_SET view, described in "Oracle Database Vault Data Dictionary Views".

See also "Assignment Rule Set" for more information about assigning rule sets to factors.

get_expr

Valid PL/SQL expression that retrieves the identity of a factor. It can use up to 255 characters in mixed-case. See "Retrieval Method" for more information. See also the audit_options parameter.

validate_expr

Name of the procedure to validate factor. This is a valid PL/SQL expression that returns a Boolean value (TRUE or FALSE) to validate the identity of the factor. See "Validation Method" for more information.

identify_by

Options for determining the identity of a factor, based on the expression set for the get_expr parameter:

• 0: By constant

• 1: By method

• 2: By factor

• 3: By context

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_IDENTIFY_BY_CONSTANT

• G_IDENTIFY_BY_METHOD

• G_IDENTIFY_BY_FACTOR

• G_IDENTIFY_BY_CONTEXT

See "Factor Identification" for more information.

labeled_by

Options for labeling the factor:

• 0: Labels the identities for the factor directly from the labels associated with an Oracle Label Security policy

• 1: Derives the factor identity label from the labels of its child factor identities.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_LABELED_BY_SELF

• G_LABELED_BY_FACTORS

The default for labeled_by is the previously set value, which you can find by querying the DVSYS.DBA_DV_FACTOR data dictionary view.

See "Factor Labeling" for more information.

eval_options

Options for evaluating the factor when the user logs on:

• 0: When the database session is created

• 1: Each time the factor is accessed

• 2: On start-up

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_EVAL_ON_SESSION

• G_EVAL_ON_ACCESS

• G_EVAL_ON_ACCESS

The default for eval_options is the previously set value, which you can find by querying the DVSYS.DBA_DV_FACTOR data dictionary view.

See "Evaluation" for more information.

audit_options

Options for auditing the factor if you want to generate a custom Oracle Database Vault audit record.

• 0: Disables auditing.

• POWER(2,0): Always audits.

• POWER(2,1): Audits if get_expr returns an error.

• POWER(2,2): Audits if get_expr is null.

• POWER(2,3): Audits if the validation procedure returns an error.

• POWER(2,4): Audits if the validation procedure is false.

• POWER(2,5): Audits if there is no trust level set.

• POWER(2,6): Audits if the trust level is negative.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_AUDIT_OFF

• G_AUDIT_ALWAYS

• G_AUDIT_ON_GET_ERROR

• G_AUDIT_ON_GET_NULL

• G_AUDIT_ON_VALIDATE_ERROR

• G_AUDIT_ON_VALIDATE_FALSE

• G_AUDIT_ON_TRUST_LEVEL_NULL

• G_AUDIT_ON_TRUST_LEVEL_NEG

The default for audit_options is the previously set value, which you can find by querying the DVSYS.DBA_DV_FACTOR data dictionary view.

See "Audit Options" for more information.

fail_options

Options for reporting factor errors:

• POWER(2,0): Shows an error message.

• POWER(2,1): Does not show an error message.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_FAIL_WITH_MESSAGE

• G_FAIL_SILENTLY

The default for fail_options is the previously set value, which you can find by querying the DVSYS.DBA_DV_FACTOR data dictionary view.

See "Error Options" for more information.

name

Factor type name.

To find existing factor types in the current database instance, query the DVSYS.DBA_DV_FACTOR_TYPE view, described in "DBA_DV_FACTOR_TYPE View".

description

Description of the purpose of the factor type, up to 1024 characters in mixed case.

factor_name

Factor name.

To find existing factors in the current database instance, query the DBSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View".

To find factors that have identities, query DVSYS.DBA_DV_IDENTITY, described in "DBA_DV_IDENTITY View".

value

New factor identity, up to 1024 characters in mixed-case. For example, the identity of an IP_Address factor could be the IP address of 192.0.2.12.

trust_level

Number that indicates the magnitude of trust relative to other identities for the same factor. In general, the higher the trust level number is set, the greater the trust. A trust level of 10 indicates "very trusted." Negative trust levels are not trusted.

See "Creating and Configuring a Factor Identity" for more information about trust levels and label security.

role_name

Role name, up to 30 characters, with no spaces. Preferably, enter the role name in upper case letters, though you are not required to do so.

To find existing secure application roles in the current database instance, query the DVSYS.DBA_DV_ROLE view, described in "DBA_DV_ROLE View".

enabled

Y (yes) makes the role available for enabling; N (no) prevents the role from being enabled. The default is Y.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_YES

• G_NO

rule_set_name

Name of rule set to determine whether a user can set this secure application role.

To find existing rule sets in the current database instance, query the DVSYS.DBA_DV_RULE_SET view, described in "DBA_DV_RULE_SET View".

role_name

Role name.

To find existing secure application roles in the current database instance, query the DVSYS.DBA_DV_ROLE view, described in "DBA_DV_ROLE View".

role_name

Current role name. Preferably, enter the role name in upper case letters, though you are not required to do so.

To find existing secure application roles in the current database instance, query the DVSYS.DBA_DV_ROLE view, described in "DBA_DV_ROLE View".

new_role_name

Role name, up to 30 characters, in uppercase, with no spaces. Ensure that this name follows the standard Oracle naming conventions for role creation described in Oracle Database SQL Language Reference.

role_name

Role name.

To find existing secure application roles in the current database instance, query the DVSYS.DBA_DV_ROLE view, described in "DBA_DV_ROLE View".

enabled

Y (yes) makes the role available for enabling; N (no) prevents the role from being enabled.

You can also use the following DVSYS.DBMS_MACUTL constants:

• G_YES

• G_NO

The default for enabled is the previously set value, which you can find by querying the DVSYS.DBA_DV_ROLE data dictionary view.

rule_set_name

Name of rule set to determine whether a user can set this secure application role.

To find existing rule sets in the current database instance, query the DVSYS.DBA_DV_RULE_SET view, described in "DBA_DV_RULE_SET View".

policy_name

Name of an existing policy.

To find existing policies in the current database instance, query the DVSYS.DBA_DV_MAC_POLICY view, described in "DBA_DV_MAC_POLICY View".

algorithm

Merge algorithm for cases when Oracle Label Security has merged two labels. Enter the code listed in Table 12-57 that corresponds to the merge algorithm you want. For example, enter HUU to if you want to select the Maximum Level/Union/Union merge algorithm.

For more information on label-merging algorithms, see Oracle Label Security Administrator's Guide.

HUU

Maximum Level/Union/Union

HIU

Maximum Level/Intersection/Union

HMU

Maximum Level/Minus/Union

HNU

Maximum Level/Null/Union

HUI

Maximum Level/Union/Intersection

HII

Maximum Level/Intersection/Intersection

HMI

Maximum Level/Minus/Intersection

HNI

Maximum Level/Null/Intersection

HUM

Maximum Level/Union/Minus

HIM

Maximum Level/Intersection/Minus

HMM

Maximum Level/Minus/Minus

HNM

Maximum Level/Null/Minus

HUN

Maximum Level/Union/Null

HIN

Maximum Level/Intersection/Null

HMN

Maximum Level/Minus/Null

HNN

Maximum Level/Null/Null

LUU

Minimum Level/Union/Union

LIU

Minimum Level/Intersection/Union

LMU

Minimum Level/Minus/Union

LNU

Minimum Level/Null/Union

LUI

Minimum Level/Union/Intersection

LII

Minimum Level/Intersection/Intersection

LMI

Minimum Level/Minus/Intersection

LNI

Minimum Level/Null/Intersection

LUM

Minimum Level/Union/Minus

LIM

Minimum Level/Intersection/Minus

LMM

Minimum Level/Minus/Minus

LNM

Minimum Level/Null/Minus

LUN

Minimum Level/Union/Null

LIN

Minimum Level/Intersection/Null

LMN

Minimum Level/Minus/Null

LNN

Minimum Level/Null/Null

identity_factor_name

Name of the factor being labeled.

To find existing factors in the current database instance, query the DVSYS.DBA_DV_FACTOR view, described in "DBA_DV_FACTOR View".

To find factors that are associated with Oracle Label Security policies, use DVSYS.DBA_DV_MAC_POLICY_FACTOR, described in "DBA_DV_MAC_POLICY_FACTOR View".

See also "Label Security Policy Factors" for more information.

identity_factor_value

Value of identity for the factor being labeled.

To find the identities of existing factors in the current database instance, query the DVSYS.DBA_DV_IDENTITY view, described in "DBA_DV_IDENTITY View".

policy_name

Name of an existing policy.

To find existing policies in the current database instance, query the DVSYS.DBA_DV_MAC_POLICY view, described in "DBA_DV_MAC_POLICY View".

label

Oracle Label Security label name.

To find existing policy labels for factor identifiers, query the DVSYS.DBA_DV_POLICY_LABEL view, described in "DBA_DV_POLICY_LABEL View".

policy_name

Name of an existing policy.

To find existing policies in the current database instance, query the DVSYS.DBA_DV_MAC_POLICY view, described in "DBA_DV_MAC_POLICY View".

policy_name

Name of an existing policy.

To find existing policies in the current database instance, query the DVSYS.DBA_DV_MAC_POLICY view, described in "DBA_DV_MAC_POLICY View".

factor_name

Name of factor associated with the Oracle Label Security label.

To find factors that are associated with Oracle Label Security policies, query DVSYS.DBA_DV_MAC_POLICY_FACTOR, described in "DBA_DV_MAC_POLICY_FACTOR View".

identity_factor_name

Name of the factor that was labeled.

To find existing factors in the current database instance that are associated with Oracle Label Security policies, query DVSYS.DBA_DV_MAC_POLICY_FACTOR, described in "DBA_DV_MAC_POLICY_FACTOR View".

See also "Label Security Policy Factors" for more information.

identity_factor_value

Value of identity for the factor that was labeled.

To find the identities of existing factors in the current database instance, query the DVSYS.DBA_DV_IDENTITY view, described in "DBA_DV_IDENTITY View".

policy_name

Name of an existing policy.

To find existing policies in the current database instance, query the DVSYS.DBA_DV_MAC_POLICY view, described in "DBA_DV_MAC_POLICY View".

label

Oracle Label Security label name.

To find existing policy labels for factor identifiers, query the DVSYS.DBA_DV_POLICY_LABEL view, described in "DBA_DV_POLICY_LABEL View".

policy_name

Name of an existing policy.

To find existing policies in the current database instance, query the DVSYS.DBA_DV_MAC_POLICY view, described in "DBA_DV_MAC_POLICY View".

algorithm

Merge algorithm for cases when Oracle Label Security has merged two labels. See Table 12-57 for listing of the available algorithms.

For more information on label-merging algorithms, see Oracle Label Security Administrator's Guide.

language

Enter one of the following settings. (This parameter is case insensitive.)

• ENGLISH

• GERMAN

• SPANISH

• FRENCH

• ITALIAN

• JAPANESE

• KOREAN

• BRAZILIAN PORTUGUESE

• SIMPLIFIED CHINESE

• TRADITIONAL CHINESE

user_name

Name of the Oracle Data Pump user to whom you want to grant authorization.

To find a list of users who have privileges to use Oracle Data Pump (that is, the EXP_FULL_DATABASE and IMP_FULL_DATABASE roles), query the DBA_ROLE_PRIVS data dictionary view as follows:

SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS WHERE GRANTED_ROLE LIKE '%FULL%'

schema_name

Name of the database schema that the Oracle Data Pump user must export or import. If you omit this parameter, then the user is granted global authorization to export and import any schema in the database. In this case, ensure the user has been granted the DV_OWNER or DV_ADMIN role.

table_name

Name of the table within the schema specified by the schema_name parameter. If you omit this parameter, then the user you specified can export and import all tables within the schema specified by the schema_name parameter.

user_name

Name of the user to whom you want to grant authorization.

To find a list of users who have privileges to schedule jobs, query the DBA_SYS_PRIVS data dictionary view for users who have privileges to schedule database jobs. See Step 2 in "Granting a Database Administrator Authorization to Use Oracle Data Pump".

schema_name

Name of the database schema for which a job will be scheduled. If you omit this parameter, then the user is granted global authorization to schedule a job for any schema in the database.

user_name

Name of the Oracle Data Pump user from whom you want to revoke authorization.

To find a list of users and authorizations from the AUTHORIZE_DATAPUMP_USER procedure, query the DVSYS.DBA_DV_RULE_SET data dictionary view as follows:

SELECT RULE_EXPR FROM DVSYS.DBA_DV_RULE_SET WHERE RULE_SET_NAME = 'Allow Oracle Data Pump Operation';

schema_name

Name of the database schema that the Oracle Data Pump user is authorized to export or import.

table_name

Name of the table within the schema specified by the schema name parameter.

user_name

Name of the job scheduling user from whom you want to revoke authorization.

To find a list of users and authorizations from the AUTHORIZE_SCHEDULER_USER procedure, query the DVSYS.DBA_DV_RULE_SET data dictionary view as follows:

SELECT RULE_EXPR FROM DVSYS.DBA_DV_RULE_SET WHERE RULE_SET_NAME = 'Allow Scheduler Job';

schema_name

Name of the database schema for which the user is authorized to schedule jobs.