ACE Director Alum Daniel Morgan, founder of Morgan's Library, is scheduling
complimentary technical Workshops on Database Security for the first 30
Oracle Database customers located anywhere in North America, EMEA, LATAM, or
APAC that send an email to
asra_us@oracle.com. Request a Workshop for
your organization today.
Purpose
Provides security for network related PL/SQL packages UTL_TCP, UTL_HTTP, UTL_SMTP, UTL_MAIL, and UTL_INADDR
AUTHID
DEFINER
Constants
Name
Data Type
Value
DOMAIN_MASK
VARCHAR2(80)
'\*(\.[^\.\*]+)*'
HOSTNAME_MASK
VARCHAR2(80)
'[^\.\*]+(\.[^\.\*]+)*'
IP_ADDR_MASK
VARCHAR2(80)
'([[:digit:]]+\.){3}[[:digit:]]+'
IP_SUBNET_MASK
VARCHAR2(80)
'([[:digit:]]+\.){0,3}\*'
Privilege
VARCHAR2
'connect' or 'resolve' (case sensitive)
Data Types
TYPE aclid_table IS TABLE OF NUMBER INDEX BY BINARY INTEGER;
Adds a privilege to grant or deny the network access to the user in an access control list (ACL)
Deprecated in 12.2: Use APPEND_HOST_ACE
dbms_network_acl_admin.add_privilege(
acl IN VARCHAR2,
principal IN VARCHAR2,
is_grant IN BOOLEAN,
privilege IN VARCHAR2,
position IN PLS_INTEGER DEFAULT NULL,
start_date IN TIMESTAMP WITH TIMESTAMP DEFAULT NULL,
end_date IN TIMESTAMP WITH TIMESTAMP DEFAULT NULL);
Append an access control entry (ACE) to the access control list (ACL) of a network host.
The ACL controls access to the given host from the database and the ACE specifies the privileges granted to or denied from the specified principal.
dbms_network_acl_admin.append_host_ace(
host IN VARCHAR2,
lower_port in PLS_INTEGER DEFAULT NULL,
upper_port in PLS_INTEGER DEFAULT NULL,
ace in xs$ace_type);
Append access control entries (ACE) of an access control list (ACL) to the ACL of a network host
dbms_network_acl_admin.append_host_acl(
host IN VARCHAR2,
lower_port in PLS_INTEGER DEFAULT NULL,
upper_port in PLS_INTEGER DEFAULT NULL,
acl IN VARCHAR2);
Append an access control entry (ACE) to the access control list (ACL) of a wallet.
The ACL controls access to the given wallet from the database and the ACE specifies the privileges granted to or denied from the specified principal.
dbms_network_acl_admin.append_wallet_ace(
wallet_path IN VARCHAR2,
ace in xs$ace_type);
Creates an access
control list (ACL) with an initial privilege setting
Deprecated in 12.2: APPEND_HOST_ACE
dbms_network_acl_admin.create_acl(
acl IN VARCHAR2,
description IN VARCHAR2,
principal IN VARCHAR2,
is_grant IN BOOLEAN,
privilege IN VARCHAR2,
start_date IN TIMESTAMP WITH TIMEZONE DEFAULT NULL,
end_date IN TIMESTAMP WITH TIMEZONE DEFAULT NULL );
conn sys@pdbdev as sysdba
desc xds_acl
set pagesize 121
col description format a60
SELECT aclid, shared, description
FROM xds_acl;
SELECT any_path
FROM resource_view
WHERE any_path LIKE '/sys/acls/%.xml';
BEGIN
dbms_network_acl_admin.create_acl(acl => 'mlib-org-permissions.xml',
description => 'Network permissions for *.morganslibrary.org',
principal => 'UWCLASS', is_grant => TRUE, privilege => 'connect');
END;
/
SELECT aclid, shared, description
FROM xds_acl;
SELECT any_path
FROM resoure_view
WHERE any_path LIKE '/sys/acls/%.xml';
Deletes a privilege in an access control list (ACL)
Deprecated in 12.2: Use REMOVE_HOST_ACE
dbms_network_acl_admin.delete_privilege(
acl IN VARCHAR2,
principal IN VARCHAR2,
is_grant IN BOOLEAN DEFAULT NULL,
privilege IN VARCHAR2 DEFAULT NULL);
BEGIN
dbms_network_acl_admin.delete_privilege('mlib-org-permissions.xml', 'UWCLASS', NULL, 'connect');
END;
/
dbms_network_acl_import.instance_callout_imp(
obj_name IN VARCHAR2,
obj_schema IN VARCHAR2,
obj_type IN NUMBER,
prepost IN BINARY_INTEGER,
action OUT VARCHAR2,
alt_name OUT VARCHAR2);
CREATE TABLE x AS
SELECT * FROM tab$;
DECLARE
act VARCHAR2(60);
alt VARCHAR2(60);
BEGIN
dbms_network_acl_admin.instance_callout_imp('X', USER, 2, 0, act, alt);
dbms_output.put_line(act);
dbms_output.put_line(alt);
END;
/
-- fails with ORA-31623: a job is not attached to this session via the specific handle which is to be expected
Remove privileges from access control entries (ACE) in the access control list (ACL) of a network host matching the given ACE
dbms_network_acl_admin.remove_host_ace(
host IN VARCHAR2,
lower_port IN PLS_INTEGER DEFAULT NULL,
upper_port IN PLS_INTEGER DEFAULT NULL,
ace IN xs$ace_type,
remove_empty_acl IN BOOLEAN DEFAULT FALSE);
Set the access control list (ACL) of a network host which controls access to the host from the database
dbms_network_acl_admin.set_host_acl(
host IN VARCHAR2,
lower_port IN PLS_INTEGER DEFAULT NULL,
upper_port IN PLS_INTEGER DEFAULT NULL,
acl IN VARCHAR2);
