11 Oracle Database Vault Objects

DVSYS Schema

The DVSYS schema contains Oracle Database Vault database objects, which store Oracle Database Vault configuration information and support the administration and run-time processing of Oracle Database Vault. In a default installation, the DVSYS schema is locked. The DVSYS schema also owns the AUDIT_TRAIL$ table.

Oracle Database Vault secures the DVSYS schema by using a protected schema design. A protected schema design guards the schema against improper use of system privileges (for example, SELECT ANY TABLE, CREATE ANY VIEW, or DROP ANY).

Oracle Database Vault protects and secures the DVSYS schema in the following ways:

• The DVSYS protected schema and its administrative roles cannot be dropped. By default, the DVSYS account is locked.

• Statements such as CREATE USER, ALTER USER, DROP USER, CREATE PROFILE, ALTER PROFILE, and DROP PROFILE can only be issued by a user with the DV_ACCTMGR role. SYSDBA can issue these statements only if it is allowed to do so by modifying the Can Maintain Accounts/Profiles rule set.

• The powerful ANY system privileges for database definition language (DDL) and data manipulation language (DML) commands are blocked in the protected schema. This means that the objects in the DVSYS schema must be created by the schema account itself. Also, access to the schema objects must be authorized through object privilege grants.

• Object privileges in the DVSYS schema can only be granted to administrative roles in the schema. This means that users can access the protected schema only through predefined administrative roles.

• Only the protected schema account DVSYS can issue ALTER ROLE statements on predefined administrative roles of the schema. "Oracle Database Vault Roles" describes Oracle Database Vault administrative roles in detail.

• Only the protected schema account DVSYS can grant predefined roles to users along with the ADMIN OPTION. This means that a grantee with the ADMIN OPTION can grant the role to another user without the ADMIN OPTION.

• The SYS.DBMS_SYS_SQL.PARSE_AS_USER procedure cannot be used to run SQL statements on behalf of the protected schema DVSYS.

DVF Schema

The DVF schema is the owner of the Oracle Database Vault DBMS_MACSEC_FUNCTION PL/SQL package, which contains the functions that retrieve factor identities. After you install Oracle Database Vault, the installation process locks the DVF account to better secure it. When you create a new factor, Oracle Database Vault creates a new retrieval function for the factor and saves it in this schema.

About Oracle Database Vault Roles

Oracle Database Vault provides a set of roles that are required for managing Oracle Database Vault.

Figure 11-1 illustrates how these roles are designed to implement the first level of separation of duties within the database. How you use these roles depends on the requirements that your company has in place.

Figure 11-1 How Oracle Database Vault Roles Are Categorized

Description of "Figure 11-1 How Oracle Database Vault Roles Are Categorized"

Table 11-1 summarizes the privileges available with Oracle Database Vault roles. (The DV_PATCH_ADMIN, DV_STREAMS_ADMIN, DV_XSTREAM, DV_GOLDENGATE_ADMIN, and DV_GOLDENGATE_REDO_ACCESS roles are not included because they have no system privileges.)

^Footnote 1 Includes the EXECUTE privilege on all Oracle Database Vault PL/SQL packages.

^Footnote 2 Includes the EXECUTE privilege on all Oracle Database Vault PL/SQL packages.

^Footnote 3 DV_SECANALYST can query DVSYS schema objects through Oracle Database Vault-supplied views only.

^Footnote 4 DV_PUBLIC can query DVSYS schema objects through Oracle Database Vault-supplied views only.

^Footnote 5 This privilege does not include the ability to drop or alter the DVSYS account, nor change the DVSYS password.

^Footnote 6 This privilege includes ANY privileges, such as CREATE ANY, ALTER ANY, and DROP ANY.

^Footnote 7 The user with this role also must be the realm participant or owner to exercise his or her system privileges

^Footnote 8 The RESOURCE role provides the following system privileges: CREATE CLUSTER, CREATE INDEXTYPE, CREATE OPERATOR, CREATE PROCEDURE, CREATE SEQUENCE, CREATE TABLE, CREATE TRIGGER, CREATE TYPE.

DV_OWNER Database Vault Owner Role

Use the DV_OWNER role to manage the Oracle Database Vault roles and its configuration. In this guide, the example account that uses this role is lbrown_dvowner.

Privileges Associated with the DV_OWNER Role

The DV_OWNER role has the administrative capabilities that the DV_ADMIN role provides, and the reporting capabilities the DV_SECANALYST role provides. It also provides privileges for monitoring Oracle Database Vault. It is created when you install Oracle Database Vault, and has the most privileges on the DVSYS schema. In addition to DV_ADMIN role, the DV_OWNER role has the GRANT ANY ROLE, ADMINISTER DATABASE TRIGGER, and ALTER ANY TRIGGER privileges.

To find the full list of system and object privileges associated with the DV_OWNER role, log in to SQL*Plus with administrative privileges and then enter the following queries:

SELECT TABLE_NAME, OWNER, PRIVILEGE FROM DBA_TAB_PRIVS WHERE GRANTEE = 'DV_OWNER';
SELECT PRIVILEGE FROM DBA_SYS_PRIVS WHERE GRANTEE = 'DV_OWNER';

When you install and register Oracle Database Vault, the DV_OWNER account is created. The user who is granted this role is also granted the ADMIN option and can run any Oracle Database Vault roles (except DV_ACCTMGR) without the ADMIN OPTION to any account. Users granted this role also can run Oracle Database Vault reports and monitor Oracle Database Vault.

How Are GRANT and REVOKE Operations Affected by the DV_OWNER Role?

Anyone with the DV_OWNER role can grant the DV_OWNER and DV_ADMIN roles to another user. The account granted this role can revoke any granted protected schema role from another account. Accounts such as SYS or SYSTEM, with the GRANT ANY ROLE system privilege alone (directly granted or indirectly granted using a role) do not have the right to grant or revoke the DV_OWNER role to or from any other database account. Note also that a user with the DV_OWNER role cannot grant or revoke the DV_ACCTMGR role.

Managing Password Changes for Users Who Have the DV_OWNER Role

Before you can change the password for another user who has been granted the DV_OWNER role, you must revoke the DV_OWNER role from that user account. However, be cautious about revoking the DV_OWNER role. At least one user on your site must have this role granted. If another DV_OWNER user has been granted this role and needs to have his or her password changed, then you can temporarily revoke DV_OWNER from that user. Note also that if you have been granted the DV_OWNER role, then you can change your own password without having to revoke the role from yourself.

To change the DV_OWNER user password:

1. Log in to SQL*Plus using an account that has been granted the DV_OWNER role.

2. Revoke the DV_OWNER role from the user account whose password needs to change.

3. Connect as a user who has been granted the DV_ACCTMGR role and then change the password for this user.

4. Connect as the DV_OWNER user and then grant the DV_OWNER role back to the user whose password you changed.

Alternatively, you can temporarily disable Oracle Database Vault, log on as a user who has been granted the ALTER USER privilege, and then modify the DV_OWNER user password. Afterward, re-enable Database Vault. See Appendix B, "Disabling and Enabling Oracle Database Vault," for more information.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

Appendix B, "Disabling and Enabling Oracle Database Vault," explains how disable and enable Oracle Database Vault.

DV_ADMIN Database Vault Configuration Administrator Role

The DV_ADMIN role controls the Oracle Database Vault PL/SQL packages.

Privileges Associated with the DV_ADMIN Role

The DV_ADMIN role has the EXECUTE privilege on the DVSYS packages (DBMS_MACADM, DBMS_MACSECROLES, and DBMS_MACUTL). DV_ADMIN also has the capabilities provided by the DV_SECANALYST role, which allow the user to run Oracle Database Vault reports and monitor Oracle Database Vault. During installation, the DV_ADMIN role is granted to the DV_OWNER role with the ADMIN OPTION during installation.

To find the full list of system and object privileges associated with the DV_ADMIN role, log in to SQL*Plus with administrative privileges and then enter the following queries:

SELECT TABLE_NAME, OWNER, PRIVILEGE FROM DBA_TAB_PRIVS WHERE GRANTEE = 'DV_ADMIN';
SELECT PRIVILEGE FROM DBA_SYS_PRIVS WHERE GRANTEE = 'DV_ADMIN';

How Are GRANT and REVOKE Operations Affected by the DV_ADMIN Role?

Accounts such as SYS or SYSTEM, with the GRANT ANY ROLE system privilege alone do not have the rights to grant or revoke DV_ADMIN from any other database account. The user with the DV_OWNER or DV_ADMIN role can grant or revoke this role to and from any database account.

Managing Password Changes for Users Who Have the DV_ADMIN Role

Before you can change the password for a user who has been granted the DV_ADMIN role, you must revoke the DV_ADMIN role from this account. If you have been granted the DV_ADMIN role, then you can change your own password without having to revoke the role from yourself.

To change the DV_ADMIN user password:

1. Log in to SQL*Plus using an account that has been granted the DV_OWNER role.

2. Revoke the DV_ADMIN role from the user account whose password needs to change.

3. Connect as a user who has been granted the DV_ACCTMGR role and then change the password for this user.

4. Connect as the DV_OWNER user and then grant the DV_ADMIN role back to the user whose password you changed.

Alternatively, you can temporarily disable Oracle Database Vault, log on as a user who has been granted the ALTER USER privilege, and then modify the DV_ADMIN user password. Afterward, re-enable Database Vault. See Appendix B, "Disabling and Enabling Oracle Database Vault," for more information.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

Appendix B, "Disabling and Enabling Oracle Database Vault," explains how disable and enable Oracle Database Vault.

DV_MONITOR Database Vault Monitoring Role

The DV_MONITOR role enables the Oracle Enterprise Manager Grid Control agent to monitor Oracle Database Vault for attempted violations and configuration issues with realm or command rule definitions. This enables Grid Control to read and propagate realm definitions and command rule definitions between databases.

Privileges Associated with the DV_MONITOR Role

There are no system privileges associated with the DV_MONITOR role, but it does have some the SELECT privilege on some SYS and DVSYS objects. To find the full list of DV_MONITOR object privileges, log in to SQL*Plus with administrative privileges and then enter the following query:

SELECT TABLE_NAME, OWNER, PRIVILEGE FROM DBA_TAB_PRIVS WHERE GRANTEE = 'DV_MONITOR';

How Are GRANT and REVOKE Operations Affected by the DV_MONITOR Role?

By default, this role is granted to the DV_OWNER role, the DV_ADMIN role, the DV_SECANALYST role, and the DBSNMP user. Only a user who has been granted the DV_OWNER privilege can grant or revoke the DV_MONITOR role to another user. You cannot grant this role with the ADMIN option.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

Appendix B, "Disabling and Enabling Oracle Database Vault," explains how disable and enable Oracle Database Vault.

DV_SECANALYST Database Vault Security Analyst Role

Use the DV_SECANALYST role to run Oracle Database Vault reports and monitor Oracle Database Vault. This role is also used for database-related reports. In addition, this role enables you to check the DVSYS configuration by querying the DVSYS views described in "Oracle Database Vault Data Dictionary Views".

Privileges Associated with the DV_SECANALYST Role

There are no system privileges associated with the DV_SECANALYST role, but it does have the SELECT privilege for the DVSYS object schema and portions of the SYS and SYSMAN schema objects for reporting on DVSYS- and DVF-related entities. To find the full list of DV_SECANALYST object privileges, log in to SQL*Plus with administrative privileges and then enter the following query:

SELECT TABLE_NAME, OWNER, PRIVILEGE FROM DBA_TAB_PRIVS WHERE GRANTEE = 'DV_SECANALYST';

How Are GRANT and REVOKE Operations Affected by the DV_SECANALYST Role?

Any account, such as SYS or SYSTEM, with the GRANT ANY ROLE system privilege alone does not have the rights to grant this role to or revoke this role from any other database account. Only the user with the DV_OWNER role can grant or revoke this role to and from another user.

Managing Password Changes for Users Who Have the DV_SECANALYST Role

Before you can change the password for a user who has been granted the DV_SECANALYST role, you must revoke the DV_SECANALYST role from this account. If you have been granted the DV_SECANALYST role, then you can change your own password without having to revoke the role from yourself.

To change the DV_SECANALYST user password:

1. Log in to SQL*Plus using an account that has been granted the DV_OWNER role.

2. Revoke the DV_SECANALYST role from the user account whose password needs to change.

3. Connect as a user who has been granted the DV_ACCTMGR role and then change the password for this user.

4. Connect as the DV_OWNER user and then grant the DV_SECANALYST role back to the user whose password you changed.

Alternatively, you can temporarily disable Oracle Database Vault, log on as a user who has been granted the ALTER USER privilege, and then modify the DV_SECANALYST user password. Afterward, re-enable Database Vault. See Appendix B, "Disabling and Enabling Oracle Database Vault," for more information.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

Appendix B, "Disabling and Enabling Oracle Database Vault," explains how disable and enable Oracle Database Vault.

DV_STREAMS_ADMIN Oracle Streams Configuration Role

Grant the DV_STREAMS_ADMIN role to any user who is responsible for configuring Oracle Streams in an Oracle Database Vault environment. This enables the management of Oracle Streams processes to be tightly controlled by Database Vault, but does not change or restrict the way an administrator would normally configure Oracle Streams.

Privileges Associated with the DV_STREAMS_ADMIN Role

There are no system privileges associated with the DV_STREAMS_ADMIN role, but it does have the SELECT privilege on DVSYS objects. To find the full list of DV_STREAMS_ADMIN object privileges, log in to SQL*Plus with administrative privileges and then enter the following query:

SELECT TABLE_NAME, OWNER, PRIVILEGE FROM DBA_TAB_PRIVS WHERE GRANTEE = 'DV_STREAMS_ADMIN';

Be aware that the DV_STREAMS_ADMIN role does not provide a sufficient set of database privileges for configuring Oracle Streams. Rather, the DV_STREAMS_ADMIN role is an additional requirement (that is, in addition to the privileges that Oracle Streams currently requires) for database administrators to configure Oracle Streams in an Oracle Database Vault environment.

How Are GRANT and REVOKE Operations Affected by the DV_STREAMS_ADMIN Role?

You cannot grant the DV_STREAMS_ADMIN role with ADMIN OPTION. Only users who have been granted the DV_OWNER role can grant or revoke the DV_STREAMS_ADMIN role to or from other users.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

DV_XSTREAM_ADMIN XStream Administrative Role

Grant the DV_XSTREAM_ADMIN role to any user who is responsible for configuring XStream in an Oracle Database Vault environment. This enables the management of XStream processes to be tightly controlled by Database Vault, but does not change or restrict the way an administrator would normally configure XStream.

Privileges Associated with the DV_XSTREAM_ADMIN Role

There are no privileges associated with the DV_XSTREAM_ADMIN role.

Be aware that the DV_XSTREAM_ADMIN role does not provide a sufficient set of database privileges for configuring XStream. Rather, the DV_XSTREAM_ADMIN role is an additional requirement (that is, in addition to the privileges that XStream currently requires) for database administrators to configure XStream in an Oracle Database Vault environment.

How Are GRANT and REVOKE Operations Affected by the DV_XSTREAM_ADMIN Role?

You cannot grant the DV_XSTREAM_ADMIN role with ADMIN OPTION. Only users who have been granted the DV_OWNER role can grant or revoke the DV_XSTREAM_ADMIN role to or from other users.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

DV_GOLDENGATE_ADMIN Oracle GoldenGate Administrative Role

Grant the DV_GOLDENGATE_ADMIN role to any user who is responsible for configuring Oracle GoldenGate in an Oracle Database Vault environment. This enables the management of Oracle GoldenGate processes to be tightly controlled by Database Vault, but does not change or restrict the way an administrator would normally configure Oracle GoldenGate.

Privileges Associated with the DV_GOLDENGATE_ADMIN Role

There are no privileges associated with the DV_GOLDENGATE_ADMIN role.

Be aware that the DV_GOLDENGATE_ADMIN role does not provide a sufficient set of database privileges for configuring Oracle GoldenGate. Rather, the DV_GOLDENGATE_ADMIN role is an additional requirement (that is, in addition to the privileges that Oracle GoldenGate currently requires) for database administrators to configure XStream in an Oracle Database Vault environment.

How Are GRANT and REVOKE Operations Affected by the DV_GOLDENGATE_ADMIN Role?

You cannot grant the DV_GOLDENGATE_ADMIN role with ADMIN OPTION. Only users who have been granted the DV_OWNER role can grant or revoke the DV_GOLDENGATE_ADMIN role to or from other users.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

DV_GOLDENGATE_REDO_ACCESS Oracle GoldenGate Redo Log Access Role

Grant the DV_GOLDENGATE_REDO_ACCESS role to any user who is responsible for using the Oracle GoldenGate TRANLOGOPTIONS DBLOGREADER method to access redo logs in an Oracle Database Vault environment. This enables the management of Oracle GoldenGate processes to be tightly controlled by Database Vault, but does not change or restrict the way an administrator would normally configure Oracle GoldenGate.

Privileges Associated with the DV_GOLDENGATE_REDO_ACCESS Role

There are no privileges associated with the DV_GOLDENGATE_REDO_ACCESS role.

Be aware that the DV_GOLDENGATE_REDO_ACCESS role does not provide a sufficient set of database privileges for configuring Oracle GoldenGate. Rather, the DV_GOLDENGATE_REDO_ACCESS role is an additional requirement (that is, in addition to the privileges that Oracle GoldenGate currently requires) for database administrators to configure Oracle Streams in an Oracle Database Vault environment.

How Are GRANT and REVOKE Operations Affected by the DV_GOLDENGATE_REDO_ACCESS Role?

You cannot grant the DV_GOLDENGATE_REDO_ACCESS role with ADMIN OPTION. Only users who have been granted the DV_OWNER role can grant or revoke the DV_GOLDENGATE_REDO_ACCESS role to or from other users.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

DV_PATCH_ADMIN Database Vault Database Patch Role

Temporarily grant the DV_PATCH_ADMIN role to any database administrator who is responsible for performing database patching or adding languages to Database Vault. After the patch operation or language addition is complete, you should immediately revoke this role.

Privileges Associated with the DV_PATCH_ADMIN Role

This role does not provide access to any secured data.

How Are GRANT and REVOKE Operations Affected by the DV_OWNER Role?

Only a user who has the DV_OWNER role can grant or revoke the DV_PATCH_ADMIN role to and from another user. You cannot grant the DV_PATCH_ADMIN role with the ADMIN option.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

Appendix B, "Disabling and Enabling Oracle Database Vault," explains how disable and enable Oracle Database Vault.

DV_ACCTMGR Database Vault Account Manager Role

Use the DV_ACCTMGR role to create and maintain database accounts and database profiles. In this manual, the example DV_ACCTMGR role is assigned to a user named amalcolm_dvacctmgr.

Privileges Associated with the DV_ACCTMGR Role

A user who has been granted this role can use the CREATE, ALTER, and DROP statements for users or profiles. However, a person who has been granted the DV_ACCTMGR role cannot perform the following operations:

• ALTER or DROP statements on the DVSYS account

• ALTER or DROP statements on users who have been granted the DV_ADMIN, DV_OWNER, DV_SECANALYST, and DV_MONITOR roles

• Change passwords for users who have been granted the DV_ADMIN, DV_OWNER, DV_SECANALYST, and DV_MONITOR roles

To find the full list of system and object privileges associated with the DV_ACCTMGR role, log in to SQL*Plus with administrative privileges and then enter the following queries:

SELECT TABLE_NAME, OWNER, PRIVILEGE FROM DBA_TAB_PRIVS WHERE GRANTEE = 'DV_ACCTMGR';
SELECT PRIVILEGE FROM DBA_SYS_PRIVS WHERE GRANTEE = 'DV_ACCTMGR';

How Are GRANT and REVOKE Operations Affected by the DV_ACCTMGR Role?

Any account, such as SYS or SYSTEM, with the GRANT ANY ROLE system privilege alone does not have the rights to grant this role to or revoke this role from any other database account. The account with the DV_ACCTMGR role and the ADMIN OPTION can grant this role without the ADMIN OPTION to any given database account and revoke this role from another account.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

Appendix B, "Disabling and Enabling Oracle Database Vault," explains how disable and enable Oracle Database Vault.

DV_REALM_OWNER Database Vault Realm DBA Role

Use the DV_REALM_OWNER role to manage database objects in multiple schemas that define a realm. Grant this role to the database account owner who is responsible for managing one or more schema database accounts within a realm and the roles associated with the realm.

Privileges Associated with the DV_REALM_OWNER Role

A user who has been granted this role can use powerful system privileges like CREATE ANY, ALTER ANY, and DROP ANY within the realm. However, before this user can exercise these privileges, you must make this user either a participant or an owner for the realm. See "Defining Realm Authorization" for instructions.

There are no object privileges granted to the DV_REALM_OWNER role, but it does have some system privileges. To find the full list of DV_REALM_OWNER system privileges, log in to SQL*Plus with administrative privileges and enter the following query:

SELECT PRIVILEGE FROM DBA_SYS_PRIVS WHERE GRANTEE = 'DV_REALM_OWNER';

How Are GRANT and REVOKE Operations Affected by the DV_REALM_OWNER Role?

The realm owner of the Oracle Data Dictionary realm, such as SYS, can grant this role to any given database account or role. Note that though this role has system privilege grants that SYS controls, it does not have the DV_OWNER or DV_ADMIN roles.

If you want to attach this role to a specific realm, then you must assign it to an account or business-related role, then authorize that account or role in the realm.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

Appendix B, "Disabling and Enabling Oracle Database Vault," explains how disable and enable Oracle Database Vault.

DV_REALM_RESOURCE Database Vault Application Resource Owner Role

Use the DV_REALM_RESOURCE role for operations such as creating tables, views, triggers, synonyms, and other objects that a realm would typically use.

Privileges Associated with the DV_REALM_RESOURCE Role

The DV_REALM_RESOURCE role provides the same system privileges as the Oracle RESOURCE role. In addition, both CREATE SYNONYM and CREATE VIEW are granted to this role.

There are no object privileges granted to the DV_REALM_RESOURCE role, but it does have some system privileges. To find the full list of DV_REALM_RESOURCE system privileges, log in to SQL*Plus with administrative privileges and enter the following query:

SELECT PRIVILEGE FROM DBA_SYS_PRIVS WHERE GRANTEE = 'DV_REALM_RESOURCE';

Though this role has system privilege grants that SYS controls, it does not have the DV_OWNER or DV_ADMIN role.

How Are GRANT and REVOKE Operations Affected by the DV_REALM_RESOURCE Role?

You can grant the DV_REALM_RESOURCE role to a database account that owns database tables, objects, triggers, views, procedures, and so on that are used to support any database application. This is a role designed for a schema type database account. The realm owner of the Oracle Data Dictionary realm, such as SYS, can grant this role to any database account or role.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

Appendix B, "Disabling and Enabling Oracle Database Vault," explains how disable and enable Oracle Database Vault.

DV_PUBLIC Database Vault PUBLIC Role

Use the DV_PUBLIC role to grant privileges on specific objects in the DVSYS schema. (Remember that in a default installation, the DVSYS schema is locked.)

Privileges Associated with the DV_PUBLIC Role

The following Oracle Database Vault objects are accessible through DV_PUBLIC:

• PL/SQL procedures and functions, described in "Oracle Database Vault Run-Time PL/SQL Procedures and Functions". These enable access control and Oracle Label Security processing in an Oracle database.

• PL/SQL factor functions, described in "Oracle Database Vault PL/SQL Factor Functions". For the DVF schema, these are functions for each factor defined. These are functions that you can use in rule sets to inspect the SQL statement that you want the rule set to protect.

• DVSYS.DBMS_MACSEC_ROLES package, described in Chapter 13, "Using the DVSYS.DBMS_MACSEC_ROLES Package." This package enables you to check the authorization for a user or to set an Oracle Database Vault secure application role.

• DVSYS.DBMS_MACUTL package, described in Chapter 14, "Using the DVSYS.DBMS_MACUTL Package." This package is a set of general purpose utility functions that you can use throughout the application code you write for Oracle Database Vault.

There are no system privileges granted to the DV_PUBLIC role, but it does have some object privileges. To find the full list of DV_PUBLIC object privileges, log in to SQL*Plus with administrative privileges and enter the following query:

SELECT TABLE_NAME, OWNER, PRIVILEGE FROM DBA_TAB_PRIVS WHERE GRANTEE = 'DV_PUBLIC';

How Are GRANT and REVOKE Operations Affected by the DV_PUBLIC Role?

Oracle Database Vault does not enable you to directly grant object privileges in the DVSYS schema to PUBLIC. You must grant the object privilege on the DVSYS schema object the DV_PUBLIC role, and then grant DV_PUBLIC to PUBLIC. However, if you do this, it is important that you do not add more object privileges to the PUBLIC role. Doing so may undermine Oracle Database Vault security.

What Happens When Oracle Database Vault Security Is Disabled?

The granting and revoking of all protected schema roles, including DV_OWNER, is enforced only if Oracle Database Vault is enabled. If Oracle Database Vault is disabled, then any account with the GRANT ANY ROLE system privilege can perform GRANT and REVOKE operations on protected schema roles.

Appendix B, "Disabling and Enabling Oracle Database Vault," explains how disable and enable Oracle Database Vault.

DBA_DV_CODE View

The DBA_DV_CODE data dictionary view lists generic lookup codes for the user interface, error messages, constraint checking, and so on. These codes are used for the user interface, views, and for validating input in a translatable fashion.

For example:

SELECT CODE, VALUE FROM DVSYS.DBA_DV_CODE WHERE CODE_GROUP = 'BOOLEAN';

Output similar to the following appears:

CODE    VALUE
------- --------
Y       True
N       False

DBA_DV_COMMAND_RULE View

The DBA_DV_COMMAND_RULE data dictionary view lists the SQL statements that are protected by command rules. See Chapter 6, "Configuring Command Rules," for more information about command rules.

For example:

SELECT COMMAND, RULE_SET_NAME FROM DVSYS.DBA_DV_COMMAND_RULE;

Output similar to the following appears:

COMMAND         RULE_SET_NAME
--------------- -----------------------------
GRANT           Can Grant VPD Administration
REVOKE          Can Grant VPD Administration
ALTER SYSTEM    Allow System Parameters
ALTER USER      Can Maintain Own Account
CREATE USER     Can Maintain Account/Profiles
DROP USER       Can Maintain Account/Profiles
CREATE PROFILE  Can Maintain Account/Profiles
DROP PROFILE    Can Maintain Account/Profiles
ALTER PROFILE   Can Maintain Account/Profiles

DBA_DV_FACTOR View

The DBA_DV_FACTOR data dictionary view lists the existing factors in the current database instance.

For example:

SELECT NAME, GET_EXPR FROM DVSYS.DBA_DV_FACTOR WHERE NAME = 'Session_User';

Output similar to the following appears:

NAME          GET_EXPR
------------- ---------------------------------------------
Session_User  UPPER(SYS_CONTEXT('USERENV', 'SESSION_USER'))

Related Views

• DBA_DV_FACTOR_LINK View

• DBA_DV_FACTOR_TYPE View

DBA_DV_FACTOR_LINK View

The DBA_DV_FACTOR_LINK data dictionary view shows the relationships of each factor whose identity is determined by the association of child factors. The view contains one entry for each parent factor and child factor. You can use this view to resolve the relationships from the factor links to identity maps.

For example:

SELECT PARENT_FACTOR_NAME, CHILD_FACTOR_NAME FROM DVSYS.DBA_DV_FACTOR_LINK;

Output similar to the following appears:

PARENT_FACTOR_NAME             CHILD_FACTOR_NAME
------------------------------ ------------------------------
Domain                         Database_Instance
Domain                         Database_IP
Domain                         Database_Hostname

Related Views

• DBA_DV_FACTOR View

• DBA_DV_FACTOR_TYPE View

DBA_DV_FACTOR_TYPE View

The DBA_DV_FACTOR_TYPE data dictionary view lists the names and descriptions of factor types used in the system.

For example:

SELECT * FROM DVSYS.DBA_DV_FACTOR_TYPE WHERE NAME = 'Hostname';

Output similar to the following appears:

NAME      DESCRIPTION
--------- ----------------------------------------------------------------------
Time      Time-based factor

Related Views

• DBA_DV_FACTOR View

• DBA_DV_FACTOR_LINK View

DBA_DV_IDENTITY View

The DBA_DV_IDENTITY data dictionary view lists the identities for each factor.

For example:

SELECT * FROM DVSYS.DBA_DV_IDENTITY WHERE VALUE = 'GLOBAL SHARED';

Output similar to the following appears, assuming you have created only one factor identity:

FACTOR_NAME          VALUE          TRUST_LEVEL
----------------     -------------- ------------
Identification_Type  GLOBAL SHARED  1

Related Views

• DBA_DV_FACTOR View

• DBA_DV_IDENTITY_MAP View

DBA_DV_IDENTITY_MAP View

The DBA_DV_IDENTITY_MAP data dictionary view lists the mappings for each factor identity. The view includes mapping factors that are identified by other factors to combinations of parent-child factor links. For each factor, the maps are joined by the OR operation, and for different factors, the maps are joined by the AND operation.

You can use this view to resolve the identity for factors that are identified by other factors (for example, a domain) or for factors that have continuous domains (for example, Age or Temperature).

For example:

SELECT FACTOR_NAME, IDENTITY_VALUE FROM DVSYS.DBA_DV_IDENTITY_MAP;

Output similar to the following appears:

FACTOR_NAME      IDENTITY_VALUE
---------------- --------------------
Sector2_Program  Accounting-Sensitive

Related Views

• DBA_DV_FACTOR View

• DBA_DV_IDENTITY View

DBA_DV_MAC_POLICY View

The DBA_DV_MAC_POLICY data dictionary view lists the Oracle Label Security policies defined for use with Oracle Database Vault.

For example:

SELECT POLICY_NAME, ALGORITHM_CODE, ALGORITHM_MEANING 
 FROM DVSYS.DBA_DV_MAC_POLICY;

Output similar to the following appears:

POLICY_NAME     ALGORITHM_CODE    ALGORITHM_MEANING
--------------- ----------------- -----------------------
ACCESS_DATA     LUI               Minimum Level/Union/Intersection

Related Views

• DBA_DV_MAC_POLICY_FACTOR View

• DBA_DV_POLICY_LABEL View

DBA_DV_MAC_POLICY_FACTOR View

The DBA_DV_MAC_POLICY data dictionary view lists the factors that are associated with Oracle Label Security policies.

You can use this view to determine what factors contribute to the maximum session label for each policy using the DBA_DV_MAC_POLICY view.

For example:

SELECT * FROM DVSYS.DBA_DV_MAC_POLICY_FACTOR;

Output similar to the following appears:

FACTOR_NAME    MAC_POLICY_NAME
-------------- ------------------
App_Host_Name  Access Locations

Related Views

• DBA_DV_MAC_POLICY View

• DBA_DV_POLICY_LABEL View

DBA_DV_POLICY_LABEL View

The DBA_DV_POLICY_LABEL data dictionary view lists the Oracle Label Security label for each factor identifier in the DBA_DV_IDENTITY view for each policy.

For example:

SELECT * FROM DVSYS.DBA_DV_POLICY_LABEL;

Output similar to the following appears:

IDENTITY_VALUE   FACTOR_NAME     POLICY_NAME       LABEL
---------------- --------------  ----------------  ---------
App_Host_Name    Sect2_Fin_Apps  Access Locations  Sensitive

Related Views

• DBA_DV_MAC_POLICY View

• DBA_DV_MAC_POLICY_FACTOR View

DBA_DV_PUB_PRIVS View

The DBA_DV_PUB_PRIVS data dictionary view lists data reflected in the Oracle Database Vault privilege management reports used in the Oracle Database Vault Administrator (DV_ADMIN). See also "Privilege Management - Summary Reports".

For example:

SELECT USERNAME, ACCESS_TYPE FROM DVSYS.DBA_DV_PUB_PRIVS WHERE USERNAME = 'OE';

Output similar to the following appears:

USERNAME    ACCESS_TYPE
----------- -----------------
OE          PUBLIC

Related Views

• DBA_DV_USER_PRIVS View

• DBA_DV_USER_PRIVS_ALL View

• DBA_DV_ROLE View

DBA_DV_REALM View

The DBA_DV_REALM data dictionary view lists the realms created in the current database instance.

For example:

SELECT NAME, AUDIT_OPTIONS, ENABLED FROM DVSYS.DBA_DV_REALM 
  WHERE AUDIT_OPTIONS = 'N';

Output similar to the following appears:

NAME                          AUDIT_OPTIONS    ENABLED
----------------------------- ---------------- --------
Performance Statistics Realm  N                1

Related Views

• DBA_DV_REALM_AUTH View

• DBA_DV_REALM_OBJECT View

DBA_DV_REALM_AUTH View

The DBA_DV_REALM_AUTH data dictionary view lists the authorization of a named database user account or database role (GRANTEE) to access realm objects in a particular realm. See Defining Realm Authorization for more information.

For example:

SELECT REALM_NAME, GRANTEE, AUTH_RULE_SET_NAME FROM DVSYS.DBA_DV_REALM_AUTH;

Output similar to the following appears:

REALM_NAME                    GRANTEE  AUTH_RULE_SET_NAME
---------------------------- --------- ---------------------
Performance Statistics Realm  SYSADM   Check Conf Access 

Related Views

• DBA_DV_REALM View

• DBA_DV_REALM_OBJECT View

DBA_DV_REALM_OBJECT View

The DBA_DV_REALM_OBJECT data dictionary view lists the database schemas, or subsets of schemas with specific database objects contained therein, that are secured by the realms. See "Creating Realm-Secured Objects" for more information.

For example:

SELECT REALM_NAME, OWNER, OBJECT_NAME FROM DVSYS.DBA_DV_REALM_OBJECT;

Output similar to the following appears:

REALM_NAME                   OWNER    OBJECT_NAME
---------------------------- -------- -----------
Performance Statistics Realm OE       ORDERS

Related Views

• DBA_DV_REALM View

• DBA_DV_REALM_AUTH View

DBA_DV_ROLE View

The DBA_DV_ROLE data dictionary view lists the Oracle Database Vault secure application roles used in privilege management.

For example:

SELECT ROLE, RULE_NAME FROM DVSYS.DBA_DV_ROLE;

Output similar to the following appears:

ROLE               RULE_NAME
------------------ --------------------
Sector2_APP_MGR    Check App2 Access
Sector2_APP_DBA    Check App2 Access

Related Views

• DBA_DV_PUB_PRIVS View

• DBA_DV_USER_PRIVS View

• DBA_DV_USER_PRIVS_ALL View

DBA_DV_RULE View

The DBA_DV_RULE data dictionary view lists the rules that have been defined.

For example:

SELECT * FROM DVSYS.DBA_DV_RULE WHERE NAME = 'Maintenance Window';

Output similar to the following appears:

NAME                RULE_EXP
------------------- ----------------------------------------------
Maintenance Window  TO_CHAR(SYSDATE,'HH24') BETWEEN '10' AND '12'

To find the rule sets that use specific rules, query the DBA_DV_RULE_SET_RULE view.

Related Views

• DBA_DV_RULE_SET View

• DBA_DV_RULE_SET_RULE View

DBA_DV_RULE_SET View

The DBA_DV_RULE_SET data dictionary view lists the rules sets that have been created.

For example:

SELECT RULE_SET_NAME, HANDLER_OPTIONS, HANDLER FROM DVSYS.DBA_DV_RULE_SET
 WHERE RULE_SET_NAME = 'Maintenance Period';

Output similar to the following appears:

RULE_SET_NAME       HANDLER_OPTIONS  HANDLER
------------------- ---------------- ----------------------
Maintenance Period                   1 dbavowner.email_alert

Related Views

• DBA_DV_RULE View

• DBA_DV_RULE_SET_RULE View

DBA_DV_RULE_SET_RULE View

The DBA_DV_RULE_SET_RULE data dictionary view lists rules that are associated with existing rule sets.

For example:

SELECT RULE_SET_NAME, RULE_NAME, RULE_EXPR FROM DVSYS.DBA_DV_RULE_SET_RULE
 WHERE RULE_NAME = 'Is Security Officer';

Output similar to the following appears:

RULE_SET_NAME                RULE_NAME          RULE_EXP
---------------------------- ------------------ ---------------------------------
Can Grant VPD Administration Is Security Owner  DVSYS.DBMS_MACUTL.USER_HAS_ROLE_
                                                VARCHAR('DV_OWNER',dvsys.dv_
                                                login_user) = 'Y'

Related Views

• DBA_DV_RULE View

• DBA_DV_RULE_SET View

DBA_DV_USER_PRIVS View

The DBA_DV_USER_PRIVS data dictionary view lists the privileges for a database user account excluding privileges granted through the PUBLIC role.

For example:

SELECT USERNAME, ACCESS_TYPE, PRIVILEGE FROM DVSYS.DBA_DV_USER_PRIVS;

Output similar to the following appears:

USERNAME  ACCESS_TYPE          PRIVILEGE
--------- -------------------- ------------
DVSYS     DV_PUBLIC            EXECUTE
DVOWNER   DV_ADMIN             SELECT
SYS       SELECT_CATALOG_ROLE  SELECT
...

Related Views

• DBA_DV_PUB_PRIVS View

• DBA_DV_ROLE View

• DBA_DV_USER_PRIVS_ALL View

DBA_DV_USER_PRIVS_ALL View

The DBA_DV_USER_PRIVS_ALL data dictionary view lists the privileges for a database account including privileges granted through PUBLIC.     

For example:

SELECT USERNAME, ACCESS_TYPE, PRIVILEGE FROM DVSYS.DBA_DV_USER_PRIVS;

Output similar to the following appears:

USERNAME            ACCESS_TYPE  PRIVILEGE
------------------- ------------ -----------------
AMALCOLM_DVACCTMGR  CONNECT      CREATE_SESSION
LBROWN_DVOWNER      DIRECT       CREATE PROCEDURE
...

Related Views

• DBA_DV_PUB_PRIVS View

• DBA_DV_ROLE View

• DBA_DV_USER_PRIVS View