Which has the higher priority in your organization: Deploying a new database or securing the ones you already have?
Looking for a website, and resources, dedicated solely to securing Oracle databases? Check out DBSecWorx.
Purpose
Global Service Manager Administration.
There is a lot of fascinating new capability hinted at in this package. Take a close look at the constants and the dependencies.
AUTHID
DEFINER
Constants
Name
Data Type
Value
RAC Status Values
GWM_NORAC (not RAC)
PLS_INTEGER
0
GWM_RAC_ADMIN
(admin managed RAC)
PLS_INTEGER
1
GWM_RAC_POLICY
(policy managed RAC)
PLS_INTEGER
2
GWM_RAC_UNKNOWN
(unknown RAC status)
PLS_INTEGER
3
GWM_RAC_SIHA (RAC SIHA)
PLS_INTEGER
4
Data Types
TYPE target IS RECORD (db_name VARCHAR2(dbms_gsm_common.max_ident),
conn_id VARCHAR2(512),
role VARCHAR2(30),
dblink VARCHAR2(256),
jobid NUMBER);
TYPE target_set IS TABLE OF target;
TYPE chunk_list_t IS TABLE OF NUMBER index by PLS_INTEGER;
Dependencies
ALL_CHUNKS
DBMS_GSM_COMMON
KU$_STATUS
ALL_OBJECTS
DBMS_GSM_DBADMIN_LIB
MESSAGE_PARAM_LIST
ALL_SERVICES
DBMS_GSM_FIXED
OBJ$
ALL_TAB_PARTITIONS
DBMS_GSM_UTILITY
PARTCOL$
ALL_USERS
DBMS_LOCK
PLITBLM
CDB_SERVICES
DBMS_OUTPUT
REGION
CHUNKDATA_TMP
DBMS_SERVICE
REGION_LIST_T
CHUNKRANGE_LIST_T
DBMS_SERVICE_PRVT
REGION_T
CHUNKRANGE_T
DBMS_SQL
SERVICE_DSC_LIST_T
CHUNKS
DBMS_SYS_ERROR
SERVICE_DSC_T
CLOUD
DBMS_UTILITY
SERVICE_LIST_T
COL$
DDLID$
SERVICE_T
DATABASE_DSC_T
DUAL
SHARDKEY_COLUMNS
DATABASE_POOL
EXCHANGE
SHARD_SPACE
DBA_CONSTRAINTS
EXECASUSER
SHARD_TS_
DBA_INDEXES
EXECUTEDDL
TABLESPACE_SET
DBA_IND_PARTITIONS
GLOBAL_TABLE
TABLE_FAMILY
DBA_IND_SUBPARTITIONS
GSM_INFO
TS_SET_TABLE
DBA_LOB_PARTITIONS
GSM_LIST_T
USER_DB_LINKS
DBA_LOB_SUBPARTITIONS
GSM_T
UTL_INADDR
DBA_PART_TABLES
GV$ACTIVE_SERVICES
UTL_LMS
DBA_SERVICES
GV_$INSTANCE
UTL_RAW
DBA_TABLESPACES
INSTANCE_LIST_T
V$DATABASE
DBA_TAB_PARTITIONS
INSTANCE_T
V$RESTORE_POINT
DBA_TAB_SUBPARTITIONS
KU$_JOBDESC
V_$PARAMETER2
DBMS_ASSERT
KU$_JOBSTATUS
WARNING_LIST_T
DBMS_DATAPUMP
KU$_LOGENTRY
WARNING_T
DBMS_GSM_CLOUDADMIN
KU$_LOGLINE1010
Documented
No
First Available
12.1
Security Model
Owned by GSMADMIN_INTERNAL with EXECUTE granted to GGSYS,
GSMROOTUSER_ROLE, and GSMUSER_ROLE
dbms_gsm_dbadmin.addDatabase(
cloud_name IN VARCHAR2,
dbpool_name IN VARCHAR2,
region_name IN VARCHAR2,
db_number IN NUMBER,
num_instances_reserved IN NUMBER DEFAULT dbms_gsm_common.max_inst_default,
force IN NUMBER DEFAULT dbms_gsm_common.isFalse,
cpu_thresh IN NUMBER DEFAULT NULL,
srlat_thresh IN NUMBER DEFAULT NULL,
inShard IN NUMBER DEFAULT dbms_gsm_common.isFalse,
chunks IN NUMBER DEFAULT 0);
TBD
Overload 2
dbms_gsm_dbadmin.addDatabase(dsc IN database_dsc_t);
Creates a new global service in the database and CRS
dbms_gsm_dbadmin.addService(
service_name IN VARCHAR2,
network_name IN VARCHAR2,
rlb_goal IN NUMBER DEFAULT NULL,
clb_goal IN NUMBER DEFAULT NULL,
distr_trans IN NUMBER DEFAULT NULL,
aq_notifications IN NUMBER DEFAULT NULL,
aq_ha_notifications IN NUMBER DEFAULT NULL,
lag_property IN NUMBER DEFAULT NULL,
max_lag_value IN NUMBER DEFAULT NULL,
failover_method IN VARCHAR2 DEFAULT NULL,
failover_type IN VARCHAR2 DEFAULT NULL,
failover_retries IN NUMBER DEFAULT NULL,
failover_delay IN NUMBER DEFAULT NULL,
edition IN VARCHAR2 DEFAULT NULL,
pdb IN VARCHAR2 DEFAULT NULL,
commit_outcome IN NUMBER DEFAULT NULL,
retention_timeout IN NUMBER DEFAULT NULL,
replay_initiation_timeout IN NUMBER DEFAULT NULL,
session_state_consistency IN VARCHAR2 DEFAULT NULL,
sql_translation_profile IN VARCHAR2 DEFAULT NULL,
locality IN NUMBER DEFAULT NULL,
region_failover IN NUMBER DEFAULT NULL,
role IN NUMBER DEFAULT NULL,
proxy_db IN NUMBER DEFAULT 0,
primary_db OUT NUMBER);
exec gsmadmin_internal.dbms_gsm_dbadmin.configOGGReplication;
BEGIN gsmadmin_internal.dbms_gsm_dbadmin.configOGGReplication; END;
*
ERROR at line 1:
ORA-45568: database link to catalog is invalid
ORA-06512: at "SYS.DBMS_SYS_ERROR", line 79
ORA-06512: at "GSMADMIN_INTERNAL.DBMS_GSM_DBADMIN", line 3959
ORA-06512: at "GSMADMIN_INTERNAL.DBMS_GSM_DBADMIN", line 5728
ORA-06512: at line 1
10046 trace was run during the test shown here and revealed the following (reformatted for clarity)
ALTER SESSION SET GLOBAL_NAMES=FALSE
Queries of access$, aud_object_opt$, codeauth$, dependency$, idl_char$, idl_sb4$, idl_ub1$, idl_ub2$, obj$, codeauth$, type$, and view$
A query of v_$Pparameter2 WHERE NAME='_cloud_name'
dbms_gsm_dbadmin.executeDDLPrvt(
ddlid IN OUT NUMBER,
schema_name IN VARCHAR2,
ddl_text IN CLOB DEFAULT NULL,
operation_type IN CHAR,
params IN VARCHAR2 DEFAULT NULL,
ddlaction IN NUMBER DEFAULT dbms_gsm_common.execddl_default,
runddl OUT BOOLEAN);
DECLARE
idVal NUMBER := 42;
ddlAct NUMBER :=
gsmadmin_internal.dbms_gsm_common.execddl_default;
tfVal BOOLEAN;
BEGIN
gsmadmin_internal.dbms_gsm_dbadmin.executeDDLPrvt(idVal, 'SYS\', 'CREATE USER c##zzyzx', 'C', NULL, ddlAct, tfVal);
IF tfVal THEN
dbms_output.put_line('T');
ELSE
dbms_output.put_line('F');
END IF;
END;
/ F
PL/SQL procedure successfully completed.
SELECT username FROM dba_users WHERE username LIKE 'C%' ORDER BY 1;
-- I tried to grant DBA to the new user and was unable to but that may be the result
-- of using the wrong OPERATION_TYPE parameter rather than this proc being unable to
-- be a major security exploit. Until proven otherwise we recommend grants of execute
-- not be made without first opening an SR.
dbms_gsm_dbadmin.finishMove(
chunk_id IN BINARY_INTEGER,
db_role IN BINARY_INTEGER DEFAULT dbms_gsm_common.movechunk_source,
status IN BINARY_INTEGER DEFAULT dbms_gsm_common.movechunk_success,
timeout IN BINARY_INTEGER DEFAULT 0);
dbms_gsm_dbadmin.modifyGSM(
gsm_alias IN VARCHAR2,
endpoint IN VARCHAR2 DEFAULT NULL,
region_name IN VARCHAR2 DEFAULT NULL,
ons_port IN NUMBER DEFAULT NULL);
dbms_gsm_dbadmin.modifyService(
service_name IN VARCHAR2,
rlb_goal IN NUMBER DEFAULT NULL,
clb_goal IN NUMBER DEFAULT NULL,
distr_trans IN NUMBER DEFAULT NULL,
aq_notifications IN NUMBER DEFAULT NULL,
aq_ha_notifications IN NUMBER DEFAULT NULL,
lag_property IN NUMBER DEFAULT NULL,
max_lag_value IN NUMBER DEFAULT NULL,
failover_method IN VARCHAR2 DEFAULT NULL,
failover_type IN VARCHAR2 DEFAULT NULL,
failover_retries IN NUMBER DEFAULT NULL,
failover_delay IN NUMBER DEFAULT NULL,
edition IN VARCHAR2 DEFAULT NULL,
pdb IN VARCHAR2 DEFAULT NULL,
commit_outcome IN NUMBER DEFAULT NULL,
retention_timeout IN NUMBER DEFAULT NULL,
replay_initiation_timeout IN NUMBER DEFAULT NULL,
session_state_consistency IN VARCHAR2 DEFAULT NULL,
sql_translation_profile IN VARCHAR2 DEFAULT NULL,
locality IN NUMBER DEFAULT NULL,
region_failover IN NUMBER DEFAULT NULL,
role IN NUMBER DEFAULT NULL,
network_number IN NUMBER DEFAULT NULL,
server_pool IN VARCHAR2 DEFAULT NULL,
cardinality IN VARCHAR2 DEFAULT NULL,
proxy_db IN NUMBER DEFAULT 0,
primary_db OUT NUMBER,
instances IN VARCHAR2 DEFAULT NULL,
force IN NUMBER DEFAULT dbms_gsm_common.isFalse);
DECLARE
primDB VARCHAR2(30);
BEGIN
gsmadmin_internal.dbms_gsm_dbadmin.getHost('MLIBSERV', clb_goal=>dbms_service.clb_goal_short, primDB);
dbms_output.put_line(primDB);
END;
/
Modifies all global attributes of a global service
Overload 1
dbms_gsm_dbadmin.modifyServiceGlobalParameters(
service_name IN VARCHAR2,
rlb_goal IN NUMBER,
clb_goal IN NUMBER,
distr_trans IN NUMBER,
aq_notifications IN NUMBER,
aq_ha_notifications IN NUMBER,
lag_property IN NUMBER,
max_lag_value IN NUMBER,
failover_method IN VARCHAR2,
failover_type IN VARCHAR2,
failover_retries IN NUMBER,
failover_delay IN NUMBER,
edition IN VARCHAR2,
pdb IN VARCHAR2,
commit_outcome IN NUMBER,
retention_timeout IN NUMBER,
replay_initiation_timeout IN NUMBER,
session_state_consistency IN VARCHAR2,
sql_translation_profile IN VARCHAR2,
locality IN NUMBER,
region_failover IN NUMBER,
role IN NUMBER,
proxy_db IN NUMBER,
primary_db OUT NUMBER,
force IN NUMBER DEFAULT dbms_gsm_common.isFalse);
TBD
Overload 2
dbms_gsm_dbadmin.modifyServiceGlobalParameters(
p_service IN service_dsc_t,
primary_db OUT NUMBER,
force IN NUMBER DEFAULT dbms_gsm_common.isFalse);
dbms_gsm_dbadmin.modifyServiceLocalParameters(
service_name IN VARCHAR2,
network_number IN NUMBER,
server_pool IN VARCHAR2,
cardinality IN VARCHAR2,
instances IN VARCHAR2 DEFAULT NULL,
force IN NUMBER DEFAULT dbms_gsm_common.isFalse);
dbms_gsm_dbadmin.moveChunk(
chunk_id IN BINARY_INTEGER,
conn_str IN VARCHAR2,
timeout IN BINARY_INTEGER,
move_mode IN BINARY_INTEGER,
gsmusrpwd IN VARCHAR2,
gdsctl_id IN BINARY_INTEGER DEFAULT 0);
TBD
PREPAREMETADATALOCAL
Undocumented
dbms_gsm_dbadmin.prepareMetadataLocal(chunk_id IN NUMBER);
TBD
PREPAREMETADATAREMOTE
Undocumented
dbms_gsm_dbadmin.prepareMetadataRemote(
chunk_id IN NUMBER,
tab_filter IN VARCHAR2 DEFAULT NULL);