Oracle | SA_AUDIT

Oracle SA_AUDIT_ADMIN Version 21c

General Information

Library Note

Morgan's Library Page Header

ACE Director Alum Daniel Morgan, founder of Morgan's Library, is scheduling complimentary technical Workshops on Database Security for the first 30 Oracle Database customers located anywhere in North America, EMEA, LATAM, or APAC that send an email to asra_us@oracle.com. Request a Workshop for your organization today.

Purpose This package configures auditing for labels and policies specific to Oracle Label Security and, in addition, creates an auditing-related view.

AUTHID DEFINER

Dependencies

DBMS_ASSERT	LBAC_CACHE	LBAC_UTL
DBMS_STANDARD	LBAC_SERVICES	OLS$POL
LBAC$USER_LIBT	LBAC_STANDARD	OLS_DIP_NTFY

Documented Yes

First Available 10.1

Security Model Owned by LBACSYS with no privileges granted.

To use this package a schema must be granted the policy_DBA role.

Source {ORACLE_HOME}/rdbms/admin/prvtolsdd.plb

Subprograms

AUDIT	AUDIT_LABEL_ENABLED_SQL	NOAUDIT
AUDIT_LABEL	CREATE_VIEW	NOAUDIT_LABEL
AUDIT_LABEL_ENABLED	DROP_VIEW

AUDIT

Enables policy-specific auditing. Audit records capture Oracle OLS administrative actions and the use of Oracle Label Security privileges
that were used during logons, DML executions, and trusted stored procedure invocations

sa_audit_admin.audit(

      policy_name  IN VARCHAR2,

      users        IN VARCHAR2 DEFAULT NULL,

      audit_option IN VARCHAR2 DEFAULT NULL,

      audit_type   IN VARCHAR2 DEFAULT NULL,  -- options 'BY ACCESS' or 'BY SESSION'

      success      IN VARCHAR2 DEFAULT NULL); -- options 'SUCCESSFUL' or 'NOT SUCCESSFUL'

      

      Audit Options

      
        
          Option
          Description
        
        
          APPLY
          Audits application of specified Oracle Label Security policies to tables and schemas
        
        
          PRIVILEGES
          Audits use of all policy-specific privileges
        
        
          REMOVE
          Audits removal of specified Oracle Label Security policies from tables and schemas
        
        
          SET
          Audits the setting of user authorizations, and user and program privileges

exec sa_audit_admin.audit('DATA_ACCESS');

AUDIT_LABEL

Records policy labels during auditing sa_audit_admin.audit_label(policy_name IN VARCHAR2);

exec sa_audit_admin.audit_label('DATA_ACCESS');

AUDIT_LABEL_ENABLED

Returns a flag indicating whether labels are being recorded in audit records for the policy sa_audit_admin.audit_label_enabled(policy_name IN VARCHAR2) RETURN BOOLEAN;

BEGIN

        IF sa_audit_admin.audit_label_enabled('DATA_ACCESS') THEN

          dbms_output.put_line('T');

        ELSE

          dbms_output.put_line('F');

        END IF;

      END;

      /

      

      SELECT COUNT(*)

      FROM ols_admin.ols_aud$;

AUDIT_LABEL_ENABLED_SQL

Undocumented but identical in function to AUDIT_LABEL_ENABLED, above, except that it returns an integer value and the function can be incorporated into SQL statements sa_audit_admin.audit_label_enabled_sql(policy_name IN VARCHAR2) RETURN BINARY_INTEGER;

SELECT sa_audit_admin.audit_label_enabled_sql('DATA_ACCESS')

      FROM dual;

CREATE_VIEW

Creates an audit trail view named DBA_policyname_AUDIT_TRAIL but the user can optionally specify a different name sa_audit_admin.create_view( policy_name IN VARCHAR2, view_name IN VARCHAR2 DEFAULT NULL);

exec sa_audit_admin.create_view('DATA_ACCESS', 'OLS_AUD$_DAP');

DROP_VIEW

Drops the OLS auditing view sa_audit_admin.drop_view( policy_name IN VARCHAR2, view_name IN VARCHAR2 DEFAULT NULL);

exec sa_audit_admin.drop_view('DATA_ACCESS', 'OLS_AUD$_DAP');

NOAUDIT

Disables Oracle Label Security policy specific auditing

A list of audit options is associated with the AUDIT procedure above sa_audit_admin.noaudit( policy_name IN VARCHAR2, users IN VARCHAR2 DEFAULT NULL, audit_option IN VARCHAR2 DEFAULT NULL

exec sa_audit_admin.noaudit('DATA_ACCESS');

NOAUDIT_LABEL

Disables the auditing of policy labels sa_audit_admin.noaudit_label();

exec sa_audit_admin.noaudit_label('DATA_ACCESS');

Morgan's Library Page Footer

This site is maintained by Dan Morgan. Last Updated:

DBSecWorx