ADD_POLICY Procedure

This procedure adds a fine-grained access control policy to a table or view.

The procedure causes the current transaction, if any, to commit before the operation is carried out. However, this does not cause a commit first if it is inside a DDL event trigger.

See Also: Usage Notes

A commit is also performed at the end of the operation.

Syntax

DBMS_RLS.ADD_POLICY (
   object_schema   IN VARCHAR2 := NULL,
   object_name     IN VARCHAR2,
   policy_name     IN VARCHAR2,
   function_schema IN VARCHAR2 := NULL,
   policy_function IN VARCHAR2,
   statement_types IN VARCHAR2 := NULL,
   update_check    IN BOOLEAN  := FALSE,
   enable          IN BOOLEAN  := TRUE);

Parameters

Table 56-2 ADD_POLICY Procedure Parameters

Parameter	Description
object_schema	Schema containing the table or view (logon user, if NULL).
object_name	Name of table or view to which the policy is added.
policy_name	Name of policy to be added. It must be unique for the same table or view.
function_schema	Schema of the policy function (logon user, if NULL).
policy_function	Name of a function which generates a predicate for the policy. If the function is defined within a package, then the name of the package must be present.
statement_types	Statement types that the policy will apply. It can be any combination of SELECT, INSERT, UPDATE, and DELETE. The default is to apply to all of these types.
update_check	Optional argument for INSERT or UPDATE statement types. The default is FALSE. Setting update_check to TRUE causes the server to also check the policy against the value after insert or update.
enable	Indicates if the policy is enabled when it is added. The default is TRUE

Usage Notes

• SYS is free of any security policy.

• The policy functions which generate dynamic predicates are called by the server. Following is the interface for the function:

      FUNCTION policy_function (object_schema IN VARCHAR2, object_name VARCHAR2) 
          RETURN VARCHAR2 
      --- object_schema is the schema owning the table of view.
      --- object_name is the name of table of view that the policy will apply. 
  
  

  The maximum length of the predicate that the policy function can return is 32K.

• The policy functions must have the purity level of WNDS (write no database state).

  See Also: The Oracle9i Application Developer's Guide - Fundamentals has more details about the RESTRICT_REFERENCES pragma.

• Dynamic predicates generated out of different policies for the same object have the combined effect of a conjunction (ANDed) of all the predicates.

• The security check and object lookup are performed against the owner of the policy function for objects in the subqueries of the dynamic predicates.

• If the function returns a zero length predicate, then it is interpreted as no restriction being applied to the current user for the policy.

• When table alias is required (for example, parent object is a type table) in the predicate, the name of the table or view itself must be used as the name of the alias. The server constructs the transient view as something like "select c1, c2, ... from tab where <predicate>".

• The checking of the validity of the function is done at runtime for ease of installation and other dependency issues during import/export.