Index

A

access control
- discretionary 3.5.4
- understanding 3
access mediation
- and views 3.5.5
- enforcement options 3.5.7
- introduction 3.1
- label evaluation 3.4
- program units 3.5.6
ADD_GROUPS procedure
- inverse groups 13.8.3
ALL_CONTROL option 8.1.3, 8.1.4, 8.1.8
ALL_SA_AUDIT_OPTIONS view F.1.2.1
ALL_SA_COMPARTMENTS view F.1.2.2, F.1.2.17
ALL_SA_DATA_LABELS view F.1.2.3, F.1.2.18
ALL_SA_GROUPS view F.1.2.4, F.1.2.19
ALL_SA_LABELS view F.1.2.5
ALL_SA_LEVELS view F.1.2.6
ALL_SA_POLICIES view F.1.2.7
ALL_SA_PROG_PRIVS view F.1.2.8
ALL_SA_SCHEMA_POLICIES view F.1.2.9
ALL_SA_TABLE_POLICIES view F.1.2.10
ALL_SA_USER_LABELS view F.1.2.12
ALL_SA_USER_LEVELS view F.1.2.13
ALL_SA_USER_PRIVS view F.1.2.14
ALL_SA_USERS view F.1.2.11
ALTER_GROUP_PARENT
- inverse groups 13.8.10
ALTER_GROUPS procedure
- inverse groups 13.8.4
ALTER_POLICY procedure
- inverse groups 13.8.2
ANALYZE command 12.4.1
APPLY_SCHEMA_POLICY procedure
- with inverse groups 13.3.1
APPLY_TABLE_POLICY procedure
- with inverse groups 13.3.1
architecture, Oracle Label Security 1.6
AS SYSDBA clause 12.5.3
AUDIT_LABEL_ENABLED function E.1.4
AUDIT_TRAIL parameter 10.2
auditing
- audit trails 10.1, 10.2, E.1.5
- creating audit view E.1.5
- disabling E.1.8
- dropping audit view E.1.6
- enabling
  - SA_AUDIT_ADMIN.AUDIT procedure E.1.2
- finding audit options F.1.2.1
- finding if labels are recorded E.1.4
- Oracle Label Security 10.1, 10.4
- recording policy labels E.1.3
- SA_AUDIT_ADMIN.AUDIT_LABEL_ENABLED function E.1.4
- SA_AUDIT_ADMIN.AUDIT_LABEL procedure E.1.3
- SA_AUDIT_ADMIN.CREATE_VIEW procedure E.1.5
- SA_AUDIT_ADMIN.DROP_VIEW procedure E.1.6
- SA_AUDIT_ADMIN.NOAUDIT_LABEL procedure E.1.8
- SA_AUDIT_ADMIN package E.1.1
- strategy 10.5.1
- systemwide 10.2
- types of 5.9.8
- views E.1.5

B

B-tree indexes 12.4.2

C

CDB_OLS_STATUS data dictionary view 4.1.2
CDB_OLS_STATUS view F.1.2.15
CDBs
- Oracle Label Security 1.8.2
CHAR_TO_LABEL function 6.3.1, 6.5.2, 6.5.6
CHECK_CONTROL option
- and labeling functions 8.3.1
- and label update 8.4.2, 8.4.3
- definition 8.1.4
- with other options 8.1.9
CHECK_WRITE function E.8.4
child rows
- deleting 8.5
- inserting 8.3.3
- updating 8.4.4
Cloud Control login 5.9.1
COMPACCESS privilege 3.5.2.3
- inverse groups 13.3.5, 13.6
compartments
- altering E.2.2
- creating E.2.6
- definition 2.3.3, 5.3.4
- deleting E.2.9
- example 2.3.3, 5.3.4
- finding F.1.2.28
- finding compartments user can read in session E.5.2
- finding compartments user can write to in session E.5.3
- finding user information F.1.2.2
- SA_COMPONENTS.ALTER_COMPARTMENT procedure E.2.2
- SA_COMPONENTS.CREATE_COMPARTMENT procedure E.2.6
- SA_COMPONENTS.DROP_COMPARTMENT procedure E.2.9
- SA_USER_ADMIN.ADD_COMPARTMENTS procedure E.7.2
- SA_USER_ADMIN.ALTER_COMPARTMENTS E.7.4
- SA_USER_ADMIN.DROP_COMPARTMENTS procedure E.7.8
- SA_USER_ADMIN.SET_COMPARTMENTS procedure E.7.11
- SA_USER_ADMIN package E.7.1
- setting authorizations 3.3.1.2, 5.4.4
components
- SA_COMPONENT package E.2.1
- SA_USER_ADMIN.DROP_ALL_COMPARTMENTS procedure E.7.6
CON C.4.1
configuration of Oracle Label security
- finding status F.1.2.33
- finding status in multitenant environment F.1.2.15
connection parameters C.4.1
CREATE_GROUP procedure
- inverse groups 13.8.9
CREATE_POLICY procedure
- inverse groups 13.8.1
CREATE FUNCTION statement 9.4.1
CREATE PACKAGE BODY statement 9.4.1
CREATE PACKAGE statement 9.4.1
CREATE PROCEDURE statement 9.4.1
CREATE TABLE AS SELECT statement F.2
creating databases 12.5.1

D

data
- label-based access 2.1
database links 11.2
databases, creating additional 12.5.1
data dictionary tables 2.2, 12.4.1, 12.5.1, F.1.1
data labels
- checking if label is data label E.8.5
- finding label and tag information F.1.2.3
- SA_UTL.DATA_LABEL function E.8.5
Data Pump export
- row labels 12.1.2
Data Pump import 12.2
DBA_OLS_STATUS view F.1.2.33
DBA_policyname_AUDIT_TRAIL view F.1.3
DBA_SA_AUDIT_OPTIONS view F.1.2.16
DBA_SA_COMPARTMENTS view 12.2.2.2, F.1.2.17
DBA_SA_DATA_LABELS view F.1.2.18
DBA_SA_GROUP_HIERARCHY view F.1.2.20
DBA_SA_GROUPS view 12.2.2.2, F.1.2.19
DBA_SA_LABELS view 12.2.2.2, F.1.2.21
DBA_SA_LEVELS view 12.2.2.2, F.1.2.22
DBA_SA_POLICIES view F.1.2.23
DBA_SA_PROG_PRIVS view F.1.2.24
DBA_SA_SCHEMA_POLICIES view 8.1.11, F.1.2.25
DBA_SA_TABLE_POLICIES view 8.1.11, F.1.2.26
DBA_SA_USER_COMPARTMENTS view F.1.2.28
DBA_SA_USER_GROUPS view F.1.2.29
DBA_SA_USER_LABELS view F.1.2.30
DBA_SA_USER_LEVELS view F.1.2.31
DBA_SA_USER_PRIVS view F.1.2.32
DBA_SA_USERS view F.1.2.27
default port C.4.1
default row label E.5.19
DELETE_CONTROL option 8.1.4, 8.5
DELETERESTRICT option 8.5
deleting labeled data 8.5
demobld.sql file 1.7.2
disabling OLS A.2
disabling Oracle Label Security A
discretionary access control (DAC) 3.5.4
distributed databases
- connecting to 11.2
- multiple policies 3.6.2
- Oracle Label Security configuration 11.1
- remote session label 11.3
dominance
- definition 3.4.2
- functions
  - about B.1.3.1
- greatest lower bound 6.4.4.2
- inverse groups 13.9
- least upper bound 6.4.4.1
- overview B.1.1
DOMINATED_BY function B.1.3.9
DOMINATES function B.1.1
dropping for specified compartments E.7.8
DROP USER CASCADE restriction F.2
duties
- of security administrators 1.4

E

enabling OLS A.2
enforcement options
- and UPDATE 8.4.2
- combinations of 8.1.9
- exemptions 8.1.10
- guidelines 8.1.9
- INVERSE_GROUP 13.3.1
- list of 8.1.2
- overview 8.1.1
- viewing 8.1.11
EXEMPT ACCESS POLICY privilege 8.1.10
Export utility
- LBACSYS restriction F.2
- policy enforcement 8.1.10
- row labels 3.5.2.1, 12.2.2.2
external tables 5.6.1

F

FULL privilege 3.5.2.2, 3.5.2.4
function call D.1, D.2

G

granularity
- to data access 3.4.3
GREATEST_LBOUND function
- inverse groups 13.8.14
groups
- altering E.2.3
- altering parent groups E.2.4
- creating group parent E.2.7
- definition 2.3.4, 5.3.6
- deleting E.2.10
- example 2.3.4, 5.3.6
- finding for entire database F.1.2.29
- finding hierarchy of parent-child relationships F.1.2.20
- finding policy groups F.1.2.4
- hierarchical 2.3.4, 2.5, 5.3.6, F.1.2.20
- inverse 13.2
- parent 2.3.4, 3.4.1.2, 5.3.6, 13.3.4
- read/write access 3.4.1.2
- SA_COMPONENTS.ALTER_GROUP_PARENT procedure E.2.4
- SA_COMPONENTS.ALTER_GROUP procedure E.2.3
- SA_COMPONENTS.CREATE_GROUP procedure E.2.7
- SA_COMPONENTS.DROP_GROUP E.2.10
- SA_SESSION.GROUP_READ function E.5.4
- SA_SESSION.GROUP_WRITE function E.5.5
- SA_USER_ADMIN.ADD_GROUPS procedure E.7.3
- SA_USER_ADMIN.ALTER_GROUPS procedure E.7.5
- SA_USER_ADMIN.DROP_ALL_GROUPS procedure E.7.7
- SA_USER_ADMIN.DROP_GROUPS procedure E.7.9
- SA_USER_ADMIN.SET_GROUPS procedure E.7.13
- SA_USER_ADMIN package E.7.1
- setting authorizations 3.3.1.3, 5.4.6

H

HIDE 6.1.1.2, E.6.2, E.6.3
HIDE option
- default E.6.3
- discussion of 8.1.5
- example 6.1.1.2
- importing hidden column 12.2.2.5
- inserting data 6.5.5
- not exported 12.1.2
- per-table basis 6.3.2.3
- PL/SQL restriction F.2
- policy label column
  - inserting data when hidden 6.5.5
- schema level 8.1.2

I

impdp
- See: Data Pump import
Import utility
- importing labeled data 12.2.2.1.2, 12.2.2.2
- importing policies 12.1.2
- importing unlabeled data 12.2.2.4
- with Oracle Label Security 12.2.2
indexes 12.4.2
INITIAL_LABEL variable B.3.1
INITIAL_ROW_LABEL variable B.3.1
initialization parameters
- AUDIT_TRAIL 10.2
INSERT_CONTROL option 8.1.4, 8.3.1
inserting labeled data 6.5.1, 8.3
INTO TABLE clause 12.3.2
INVERSE_GROUP enforcement option
- behavior of procedures 13.8
- implementation 13.3.1
inverse groups
- and label components 13.3.2
- COMPACCESS privilege 13.3.5, 13.6
- computed labels 13.3.3
- dominance 13.9
- implementation of 13.3
- introduction 13.2
- Max Read Groups 13.3.3.2
- Max Write Groups 13.3.3.2
- parent-child unsupported 13.3.4
- read algorithm 13.4
- session labels 13.7
- SET_DEFAULT_LABEL 13.7.1
- SET_LABEL 13.7.2.1
- SET_ROW_LABEL 13.7.1, 13.7.2.1
- user privileges 13.3.5
- write algorithm 13.5

L

LABEL_DEFAULT option
- and labeling functions 8.2.1, 8.2.2
- authorizing compartments 3.3.1.2
- authorizing groups 3.3.1.3
- importing unlabeled data 12.2.2.4
- inserting labeled data 6.5.4
- with enforcement options 8.1.9
- with SA_SESSION.SET_ROW_LABEL E.5.19
LABEL_TO_CHAR function 6.3.2.1, 6.3.2.2, 6.4.3
LABEL_UPDATE option
- and labeling functions 8.1.6.3, 8.2.2
- and privileges 8.1.6.3
- and WRITE_CONTROL 8.1.7.2
- and WRITEUP 3.5.1, 5.5.1
- definition 8.1.4
- evaluation process 8.4.2
- with enforcement options 8.1.9
label-based security 2.1
label components
- defining E.2.1
- in distributed environment 11.4
- industry examples 2.3.5
- interrelation 2.5
label evaluation process
- COMPACCESS read 3.5.2.3
- COMPACCESS write 3.5.2.3
- inverse groups, COMPACCESS 13.6
- LABEL_UPDATE 8.4.2
- read access 3.4.2
- read access, inverse groups 13.4
- write access 3.4.3
- write access, inverse groups 13.5
labeling functions
- ALL_CONTROL and NO_CONTROL 8.1.8
- and CHECK_CONTROL 8.3.1
- and LABEL_DEFAULT 8.1.6.3, 8.2.1
- and LABEL_DEFAULTlLABEL_DEFAULT option
  - and labeling functions 8.1.6.2
- and LABEL_UPDATE 8.1.6, 8.1.6.4
- and LBACSYS 8.2.2
- creating 8.2.3
- example 8.2.1
- how they work 8.2.2
- importing unlabeled data 12.2.2.4
- in force 8.1.6
- inserting data 6.5.4
- introduction 3.5.7
- override manual insert 8.3.2
- specifying 8.2.4
- testing 8.2.2
- UPDATE 8.4.3
- using 8.2.1
- with enforcement options 8.1.9
label policy containers
- creating 5.2.2
labels E.8.5, E.8.10
- administering 2.6
- altering E.3.2
- and performance 3.5.2.1
- checking if a data label E.8.5
- checking if changed E.8.2
- creating E.3.3
- data and user 2.5
- deleting E.3.4
- finding greatest lower bound E.8.6
- finding least upper bound E.8.7
- finding tags and types of F.1.2.5
- merging 6.4.5
- non-comparable B.1.2
- relationships between B.1
- restoring default for session E.5.13
- SA_LABEL_ADMIN.ALTER_LABEL procedure E.3.2
- SA_LABEL_ADMIN.CREATE_LABEL procedure E.3.3
- SA_LABEL_ADMIN.DROP_LABEL procedure E.3.4
- SA_LABEL_ADMIN package E.3.1
- SA_SESSION.LABEL function E.5.6
- SA_SESSION.MAX_READ_LABEL function E.5.8
- SA_SESSION.MAX_WRITE_LABEL function E.5.9
- SA_SESSION.MIN_WRITE_LABEL function E.5.11
- SA_SESSION.RESTORE_DEFAULT_LABELS E.5.13
- SA_SESSION.SET_LABEL procedure E.5.15
- SA_SESSION.SET_ROW_LABEL procedure E.5.19
- SA_USER_ADMIN.SET_USER_LABELS procedure E.7.17
- SA_USER_ADMIN package E.7.1
- SA_UTL.CHECK_LABEL_CHANGE function E.8.2
- SA_UTL.GREATEST_LBOUND function E.8.6
- SA_UTL.LEAST_UBOUNDfunction E.8.7
- SA_UTL.SET_LABEL procedure E.8.10
- saving default session label E.5.17
- setting row label E.5.19
- syntax 2.4, 5.3.8
- valid 2.4, 5.3.9, 6.1.2.1
- with inverse groups 13.3.3
label tags
- converting from string 6.3.1
- converting to string 6.3.2.1
- distributed environment 11.4.1
- example 6.1.2.2
- inserting data 6.5.3
- introduction 2.4, 5.3.9
- manually defined 6.1.2.2, 6.1.2.3
- strategy 12.4.3
- using in WHERE clauses 6.4.1
LBAC_LABEL data type 8.2.2
LBACSYS
- export 12.1.1
- import 12.1.1
- login 5.9.1
LBACSYS default user account
- about 4.2
- best practice guideline 4.2
- enabling 4.2
LBACSYS schema
- and labeling functions 8.2.2
- creating additional databases 12.5.1
- data dictionary tables 12.4.1
- export restriction F.2
LEAST_UBOUND function
- inverse groups 13.8.13
levels
- about 5.3.2
- altering levels E.2.5
- creating E.2.8
- definition 2.3.2, 5.3.2
- deleting E.2.11
- example 2.3.2, 5.3.2
- finding F.1.2.6
- SA_COMPONENTS.ALTER_LEVEL procedure E.2.5
- SA_COMPONENTS.CREATE_LEVEL procedure E.2.8
- SA_COMPONENTS.DROP_LEVEL procedure E.2.11
- SA_SESSION.MAX_LEVEL function E.5.7
- SA_SESSION.MIN_LEVEL function E.5.10
- SA_USER_ADMIN.SET_LEVELS procedure E.7.14
- setting authorizations 3.3.1.1, 5.4.2
logging into Oracle Label Security
- from Cloud Control 4.3.1
- from SQL*Plus 4.3.2
login
- Cloud Control 5.9.1
- LBACSYS 5.9.1

M

materialized views 11.6.1.1, 11.6.3.2
Max Read Groups 13.3.3.2
Max Write Group 13.3.3.2
MERGE_LABEL function 6.4.5
multitenant container databases
- See: CDBs

N

NO_CONTROL option 8.1.4, 8.1.8
NUMBER data type 6.1.1.1

O

object privileges
- and Oracle Label Security privileges 3.5.4
- and trusted stored program units 3.5.6, 9.2
OCI_ATTR_APPCTX_LIST B.3.2
OCI_ATTR_APPCTX_SIZE B.3.2
OCIAttrSet B.3.1, B.3.2
OCI interface B.3.1
OCIParamGet B.3.2
OLS_DOMINATED_BY function B.1.3.5
OLS_DOMINATES function B.1.3.2
OLS_GLBD function 6.4.4.2
OLS_GREATEST_LBOUND function 6.4.4.2
OLS_LABEL_DOMINATES function
- about B.1.3.3
- in Database Vault policies B.1.3.3
- in Data Redaction policies B.1.3.3
OLS_LEAST_UBOUND function 6.4.4.1
OLS_LUBD function 6.4.4.1
OLS_STRICTLY_DOMINATED_BY function B.1.3.6
OLS_STRICTLY_DOMINATES function B.1.3.4
OptionsA C.4.2
Oracle Database Vault
- using OLS_LABEL_DOMINATES function with B.1.3.3
Oracle Data Redaction
- using OLS_LABEL_DOMINATES function with B.1.3.3
Oracle Enterprise Manager
- administering labels 2.6
Oracle Internet Directory
- configuring OLS after switchover to standby database 7.11.5
- integration with OLS 1.8.1
- OID with Oracle Data Guard 7.11.5
- Oracle Label Security
  - about 7.1
  - administrator duties in 7.9
  - bootstrapping databases 7.10
  - configuring, about 7.2.1
  - configuring, permission for 7.2.2
  - configuring, steps 7.2.3
  - integrated capabilities of 7.5
  - PL/SQL procedures for policy administrators 7.14
  - policy attributes in 7.6
  - profiles, about 7.4
  - provisioning profiles, about 7.11.2
  - provisioning profiles, changing database connection information 7.11.4
  - provisioning profiles, managing 7.11.3
  - removing OID-enabled OLS from database 7.3
  - restrictions on new data label creation 7.8
  - security roles and permitted actions 7.12.1
  - subscribing policies in 7.7
  - superseded PL/SQL statements 7.13
  - synchronizing database with OID 7.11.1
  - un-registering database 7.2.4
Oracle Label Security
- about 1.1
- benefits 1.2
- checking if registered and enabled 4.1.2
- DBA_OLS_STATUS data dictionary view 4.1.2
- privileges required to use 1.3
- registering 4.1.1
Oracle Label Security (OLS)
- integration with Oracle Internet Directory 1.8.1
Oracle Label Security data dictionary views
- about F.1.2
- ALL_SA_AUDIT_OPTIONS F.1.2.1
- ALL_SA_COMPARTMENTS F.1.2.2, F.1.2.17
- ALL_SA_DATA_LABELS F.1.2.3, F.1.2.18
- ALL_SA_GROUPS F.1.2.4, F.1.2.19
- ALL_SA_LABELS F.1.2.5
- ALL_SA_LEVELS F.1.2.6, F.1.2.22
- ALL_SA_POLICIES F.1.2.7
- ALL_SA_PROG_PRIVS F.1.2.8
- ALL_SA_SCHEMA_POLICIES F.1.2.9
- ALL_SA_TABLE_POLICIES F.1.2.10
- ALL_SA_USER_LABELS F.1.2.12
- ALL_SA_USER_LEVELS F.1.2.13
- ALL_SA_USER_PRIVS F.1.2.14
- ALL_SA_USERS F.1.2.11
- CDB_OLS_STATUS F.1.2.15
- DBA_OLS_STATUS F.1.2.33
- DBA_SA_AUDIT_OPTIONS F.1.2.16
- DBA_SA_GROUP_HIERARCHY F.1.2.20
- DBA_SA_LABELS F.1.2.21
- DBA_SA_POLICIES F.1.2.23
- DBA_SA_PROG_PRIVS F.1.2.24
- DBA_SA_SCHEMA_POLICIES F.1.2.25
- DBA_SA_TABLE_POLICIES F.1.2.26
- DBA_SA_USER_COMPARTMENTS F.1.2.28
- DBA_SA_USER_GROUPS F.1.2.29
- DBA_SA_USER_LABELS F.1.2.30
- DBA_SA_USER_LEVELS F.1.2.31
- DBA_SA_USER_PRIVS F.1.2.32
- DBA_SA_USERS F.1.2.27
- policies
  - finding information about schema policies F.1.2.9
- USER_SA_SESSION F.1.2.34
Oracle Label Security profiles 7.4
ORDER BY clause 6.4.2

P

packages
- Oracle Label Security 1.7.1
- SA_AUDIT_ADMIN E.1.1
- SA_COMPONENTS E.2.1
- SA_LABEL_ADMIN E.3.1
- SA_POLICY_ADMIN E.4.1
- SA_SESSION E.5.1
- SA_SYSDBA E.6.1
- SA_USER_ADMIN E.7.1
- SA_UTL E.8.1
- trusted stored program units 9.1
partitioning 6.1.2.3, 12.4.4
PDBs
- Oracle Label Security 1.8.2
performance, Oracle Label Security
- ANALYZE command 12.4
- indexes 12.4.2
- label tag strategy 12.4.3
- partitioning 12.4.4
- READ privilege 3.5.2.1
PL/SQL
- recreating labels for import 12.2.2.2
- SA_UTL package 9.5, E.8.1
- trusted stored program units 9.1
pluggable databases
- See: PDBs
policies
- about creating 5.6.1
- enforcement guidelines 8.1.9
- enforcement options 3.5.7, 6, 8.1.1, 8.1.2, 8.1.9
- finding for current user F.1.2.7
- finding for entire database F.1.2.23
- finding information about table policies F.1.2.10
- finding privileges for program units F.1.2.8
- multiple 2.2, 6.1.2.1
- OID subscription E.4.9
- OID unsubscription E.4.10
- privileges 3.5.4, E.7.18
- SA_POLICY_ADMIN.POLICY_SUBSCRIBE procedure E.4.9
- SA_POLICY_ADMIN.POLICY_UNSUBSCRIBE procedure E.4.10
- SA_POLICY_ADMIN package E.4.1
policies, schema
- altering E.4.2
- applying E.4.3
- deleting E.4.11
- disabling E.4.5
- enabling E.4.7
- SA_POLICY_ADMIN.ALTER_SCHEMA_POLICY procedure E.4.2
- SA_POLICY_ADMIN.APPLY_SCHEMA_POLICY procedure E.4.3
- SA_POLICY_ADMIN.ENABLE_SCHEMA_POLICY policy E.4.7
- SA_POLICY_ADMIN.REMOVE_SCHEMA_POLICY procedure E.4.11
policies, schema, disabling
- SA_POLICY_ADMIN.DISABLE_SCHEMA_POLICY procedure E.4.5
policies, table
- applying E.4.4
- deleting E.4.12
- disabling E.4.6
- enabling E.4.8
- SA_POLICY_ADMIN.APPLY_TABLE_POLICY procedure E.4.4
- SA_POLICY_ADMIN.DISABLE_TABLE_POLICY procedure E.4.6
- SA_POLICY_ADMIN.ENABLE_TABLE_POLICY procedure E.4.8
- SA_POLICY_ADMIN.REMOVE_TABLE_POLICY procedure E.4.12
policy_DBA role 2.2, E.3.1, E.7.18
- about 1.4
- auditing policy_DBA role users E.1.2
- how to use 1.4
- required for Data Pump import operations 12.2.2.1.2
- required for label management E.3.1
- required for Oracle Label Security auditing E.1.1
- required for SA_USER_ADMIN.SET_PROG_PRIVS procedure E.7.15
- required for SA_USER_ADMIN.SET_USER_PRIVS procedure E.7.18
policy label column
- indexing 12.4.2
- introduction 6.1.1, 6.1.1.1
- retrieving 6.3.2.2
- retrieving hidden 6.3.2.3
- storing label tag 2.4, 5.3.9
policy label containers
- about 5.2.1
policy management
- altering policies E.6.2
- creating policies E.6.3
- deleting policies E.6.5
- disabling policies E.6.4
- enabling policies E.6.6
- SA_SYSDBA.ALTER_POLICY procedure E.6.2
- SA_SYSDBA.CREATE_POLICY procedure E.6.3
- SA_SYSDBA.DISABLE_POLICY procedure E.6.4
- SA_SYSDBA.DROP_POLICY policy E.6.5
- SA_SYSDBA.ENABLE_POLICY procedure E.6.6
- SA_SYSDBA package E.6.1
predicates
- access mediation 3.5.7
- errors 8.6.1
- label tag performance strategy 12.4.3
- multiple 8.6.2
- used with policy 8.6.1
privileges
- COMPACCESS 3.5.2.3
- FULL 3.5.2.2, 3.5.2.4
- Oracle Label Security 1.3, 3.5.1
- PROFILE_ACCESS 3.5.2.4
- program units 3.5.6
- READ 3.5.1, 3.5.2.1, 5.5.1
- row label 3.5.3
- SA_USER_ADMIN.SET_USER_PRIVS procedure E.7.18
- trusted stored program units 9.4.5
- WRITEACROSS 3.5.3, 3.5.3.3
- WRITEDOWN 3.5.3, 3.5.6
- WRITEUP 3.5.3, 3.5.3.1
PROFILE_ACCESS privilege 3.5.2.4
program units
- finding policy privileges for F.1.2.8
propagated D.1

R

RAC D.1
READ_CONTROL option
- algorithm 3.4.2
- and CHECK_CONTROL 8.1.6.4
- and child rows 8.3.3
- definition 8.1.4
- referential integrity 8.4.4
- with other options 8.1.9
- with predicates 8.6.1
read access
- algorithm 3.4.2, 3.5.2.2
- introduction 3.4.1.1
reading down 3.4.2
read label 3.3.2
READ privilege 3.5.1, 3.5.2.1, 5.5.1
re-enabling Oracle Label Security A
referential integrity 8.3.3, 8.4.4, 8.5
registering Oracle Label Security 4.1.1
releasability 13.2
remote users 11.2
REPADMIN account 11.6.3.1, 11.6.3.2
replication
- materialized views (snapshots) 11.6.1.1, 11.6.3.2, 11.6.4
- with Oracle Label Security 11.6, 11.6.1.2
replication administrator 11.6.3.1
restrictions, Oracle Label Security F.2
row labels
- default 3.3.1.2, 3.3.2, D.2, E.5.1, E.5.19, E.8.11
- example 3.2.3
- finding current E.8.9
- in distributed environment 11.3
- inserting 6.5.2
- LABEL_DEFAULT option 6.5.1, 8.1.6.2
- privileges 3.5.3
- restoring E.5.13
- SA_USER_ADMIN.SET_ROW_LABEL procedure E.7.16
- SA_UTL.NUMERIC_ROW_LABEL function E.8.9
- SA_UTL.SET_ROW_LABEL procedure E.8.11
- saving defaults E.5.17
- setting E.5.19, E.8.11
- setting compartments E.7.11
- setting for current database session E.8.11
- setting for user’s initial use E.7.16
- setting groups E.7.13
- setting levels E.7.14
- understanding 3.2.2
- updating 3.5.3
- viewing E.8.9

S

SA_AUDIT_ADMIN
- procedures, listed E.1.1
SA_AUDIT_ADMIN.AUDIT_LABEL_ENABLED procedure E.1.4
SA_AUDIT_ADMIN.AUDIT_LABEL procedure E.1.3
SA_AUDIT_ADMIN.AUDIT procedure E.1.2
SA_AUDIT_ADMIN.CREATE_VIEW procedure E.1.5
SA_AUDIT_ADMIN.DROP_VIEW procedure E.1.6
SA_AUDIT_ADMIN.NOAUDIT_LABEL procedure E.1.8
SA_AUDIT_ADMIN.NOAUDIT procedure E.1.7
SA_AUDIT_ADMIN PL/SQL package
- about E.1.1
SA_COMPONENTS
- procedures, listed E.2.1
SA_COMPONENTS.ALTER_COMPARTMENT procedure E.2.2
SA_COMPONENTS.ALTER_GROUP_PARENT procedure E.2.4
SA_COMPONENTS.ALTER_GROUP procedure E.2.3
SA_COMPONENTS.ALTER_LEVEL procedure E.2.5
SA_COMPONENTS.CREATE_COMPARTMENT procedure E.2.6
SA_COMPONENTS.CREATE_GROUP procedure E.2.7
SA_COMPONENTS.CREATE_LEVEL procedure E.2.8
SA_COMPONENTS.DROP_COMPARTMENT procedure E.2.9
SA_COMPONENTS.DROP_GROUP procedure E.2.10
SA_COMPONENTS.DROP_LEVEL procedure E.2.11
SA_COMPONENTS package E.2.1
SA_COMPONENTS PL/SQL package
- about E.2.1
SA_LABEL_ADMIN
- procedures, listed E.3.1
SA_LABEL_ADMIN.ALTER_LABEL procedure E.3.2
SA_LABEL_ADMIN.CREATE_LABEL procedure E.3.3
SA_LABEL_ADMIN.DROP_LABEL procedure E.3.4
SA_LABEL_ADMIN PL/SQL package
- about E.3.1
SA_POLICY_ADMIN
- procedures, listed E.4.1
SA_POLICY_ADMIN.ALTER_SCHEMA_POLICY procedure E.4.2
SA_POLICY_ADMIN.APPLY_SCHEMA_POLICY procedure E.4.3
SA_POLICY_ADMIN.APPLY_TABLE_POLICY procedure E.4.4
SA_POLICY_ADMIN.DISABLE_SCHEMA_POLICY procedure E.4.5
SA_POLICY_ADMIN.DISABLE_TABLE_POLICY procedure E.4.6
SA_POLICY_ADMIN.ENABLE_SCHEMA_POLICY procedure E.4.7
SA_POLICY_ADMIN.ENABLE_TABLE_POLICY procedure E.4.8
SA_POLICY_ADMIN.POLICY_SUBSCRIBE procedure E.4.9
SA_POLICY_ADMIN.POLICY_UNSUBSCRIBE procedure E.4.10
SA_POLICY_ADMIN.REMOVE_SCHEMA_POLICY procedure E.4.11
SA_POLICY_ADMIN.REMOVE_TABLE_POLICY procedure E.4.12
SA_POLICY_ADMIN PL/SQL package
- about E.4.1
SA_SESSION
- procedures and functions, listed E.5.1
SA_SESSION.COMP_READ function E.5.2
SA_SESSION.COMP_WRITE function E.5.3
SA_SESSION.GROUP_READ function E.5.4
SA_SESSION.GROUP_WRITE function E.5.5
SA_SESSION.LABEL function E.5.6
SA_SESSION.MAX_LEVEL function E.5.7
SA_SESSION.MAX_READ_LABEL function E.5.8
SA_SESSION.MAX_WRITE_LABEL function E.5.9
SA_SESSION.MIN_LEVEL function E.5.10
SA_SESSION.MIN_WRITE_LABEL function E.5.11
SA_SESSION.PRIVS function E.5.12
SA_SESSION.RESTORE_DEFAULT_LABELS procedure E.5.13
SA_SESSION.ROW_LABEL function E.5.14
SA_SESSION.SA_USER_NAME function E.5.16
SA_SESSION.SAVE_DEFAULT_LABELS procedure E.5.17
SA_SESSION.SET_ACCESS_PROFILE procedure E.5.16, E.5.18
SA_SESSION.SET_LABEL procedure E.5.15
- and SA_SESSION.RESTORE_DEFAULT_LABELS E.5.13
SA_SESSION.SET_ROW_LABEL procedure E.5.19
SA_SESSION PL/SQL package
- about E.5.1
SA_SYSDBA
- procedures, listed E.6.1
SA_SYSDBA.ALTER_POLICY procedure E.6.2
SA_SYSDBA.CREATE_POLICY procedure E.6.3
SA_SYSDBA.DISABLE_POLICY procedure E.6.4
SA_SYSDBA.DROP_POLICY procedure E.6.5
SA_SYSDBA.ENABLE_POLICY procedure E.6.6
SA_SYSDBA PL/SQL package
- about E.6.1
SA_USER_ADMIN.ADD_COMPARTMENTS procedure E.7.2
SA_USER_ADMIN.ADD_GROUPS procedure E.7.3
SA_USER_ADMIN.ALTER_COMPARTMENTS procedure E.7.4
SA_USER_ADMIN.ALTER_GROUPS procedure E.7.5
SA_USER_ADMIN.DROP_ALL_COMPARTMENTS procedure E.7.6
SA_USER_ADMIN.DROP_ALL_GROUPS procedure E.7.7
SA_USER_ADMIN.DROP_COMPARTMENTS procedure E.7.8
SA_USER_ADMIN.DROP_GROUPS procedure E.7.9
SA_USER_ADMIN.DROP_USER_ACCESS procedure E.7.10
SA_USER_ADMIN.SET_COMPARTMENTS procedure E.7.11
SA_USER_ADMIN.SET_DEFAULT_LABEL procedure E.7.12
SA_USER_ADMIN.SET_GROUPS procedure E.7.13
SA_USER_ADMIN.SET_LEVELS procedure E.7.14
SA_USER_ADMIN.SET_ROW_LABEL procedure E.7.16
SA_USER_ADMIN.SET_USER_LABELS procedure E.7.17
SA_USER_ADMIN.SET_USER_PRIVS procedure E.7.18
SA_USER_ADMIN package
- administering stored program units E.7.15
- overview 2.2
- procedures, listed E.7.1
SA_USER_ADMIN PL/SQL package
- about E.7.1
SA_UTL.CHECK_LABEL_CHANGE function E.8.2
SA_UTL.CHECK_READ function E.8.3
SA_UTL.CHECK_WRITE function E.8.4
SA_UTL.DATA_LABEL function E.8.5
SA_UTL.GREATEST_LBOUND function E.8.6
SA_UTL.LEAST_UBOUND function E.8.7
SA_UTL.NUMERIC_LABEL function E.8.8
SA_UTL.NUMERIC_ROW_LABEL function E.8.9
SA_UTL.SET_LABEL procedure E.8.10
SA_UTL.SET_ROW_LABEL procedure E.8.11
SA_UTL package
- dominance functions B.1.3.7
- overview 9.5
- procedures and functions, listed E.8.1
SA_UTL PL/SQL package
- about E.8.1
schemas
- applying policies to 8.1.9, E.6.2
- default policy options E.6.3
- restrictions on shared F.2
session labels
- changing E.5.15
- computed 3.3.2
- distributed database 11.3
- example 3.2.3
- finding E.8.8
- OCI interface B.3.1
- restoring to default E.5.13
- SA_UTL.SET_LABEL E.8.10
- saving defaults E.5.17
- setting compartments E.7.11
- setting groups E.7.13
- setting user initial E.7.12
- understanding 3.2.1
sessions
- compartments readable by user E.5.2
- compartments writeable by user E.5.3
- finding current OLS user E.5.16
- finding row label E.5.14
- finding security attributes for F.1.2.34
- finding session label number E.8.8
- finding session privileges E.5.12
- SA_SESSION.COMP_READ function E.5.2
- SA_SESSION.COMP_WRITE function E.5.3
- SA_SESSION.GROUP_READ function E.5.4
- SA_SESSION.GROUP_WRITE function E.5.5
- SA_SESSION.LABEL function E.5.6
- SA_SESSION.MAX_LEVEL function E.5.7
- SA_SESSION.MAX_READ_LABEL function E.5.8
- SA_SESSION.MAX_WRITE_LABEL function E.5.9
- SA_SESSION.MIN_LEVEL function E.5.10
- SA_SESSION.MIN_WRITE_LABEL function E.5.11
- SA_SESSION.PRIVS E.5.12
- SA_SESSION.RESTORE_DEFAULT_LABELS procedure E.5.13
- SA_SESSION.ROW_LABEL function E.5.14
- SA_SESSION.SA_USER_NAME function E.5.16
- SA_SESSION.SAVE_DEFAULT_LABELS procedure E.5.17
- SA_SESSION.SET_ACCESS_PROFILE procedure E.5.18
- SA_SESSION.SET_LABEL procedure E.5.15
- SA_SESSION package E.5.1
- SA_USER_ADMIN.SET_COMPARTMENTS procedure E.7.11
- SA_USER_ADMIN.SET_DEFAULT_LABEL procedure E.7.12
- SA_USER_ADMIN.SET_LEVELS procedure E.7.14
- SA_UTL.SET_LABEL procedure E.8.10
- SA_UTL.SET_ROW_LABEL procedure E.8.11
- saving default session label E.5.17
- setting label for E.8.10
- setting OLS privileges for user E.5.18
- setting row label for E.8.11
SET_ACCESS_PROFILE procedure F.2
SET_DEFAULT_LABEL procedure
- inverse groups 13.7.1, 13.8.7
SET_GROUPS procedure
- inverse groups 13.8.5
SET_LABEL procedure
- definition E.5.1
- inverse groups 13.7.2.1, 13.8.11
- on remote database 11.3
SET_PROG_PRIVS function E.7.15
SET_ROW_LABEL procedure 13.7.2.2, 13.7.2.3
- inverse groups 13.7.1, 13.7.2.1, 13.8.8, 13.8.12
SET_USER_LABELS procedure
- inverse groups 13.8.6
setting label for database session E.8.10
shared schema restrictions F.2
SQL*Loader 12.3
STRICTLY_DOMINATED_BY function B.1.3.10
STRICTLY_DOMINATES function B.1.3.8
SYS_CONTEXT
- and labeling functions 8.2.2
- variables B.3.1
SYS account
- policy enforcement 8.1.10
SYSDBA privilege 10.2
system privileges 3.5.4, 3.5.5, 3.5.6

T

table rows
- checking if user can read E.8.3
- checking if user can write to E.8.4
- SA_UTL.CHECK_READ function E.8.3
- SA_UTL.CHECK_WRITE function E.8.4
TO_DATA_LABEL function 6.5.6, E.3.3
TO_LBAC_DATA_LABEL function 8.2.2
TO_LBAC_DATA_LABEL function, example of using E.8.10
triggers 8.2.2
trusted program units
- about 5.5.1
trusted stored program units
- creating 9.4.1
- error handling 9.4.5
- example 9.3
- executing 9.4.5
- introduction 9.1
- privileges 3.5.6, 9.4.5
- re-compiling 9.4.3
- replacing 9.4.4

U

unified audit trail 10.4
UPDATE_CONTROL option 8.1.4, 8.4.2
updating labeled data 8.4
USER_SA_SESSION view F.1.2.34
user authorizations E.7.8
- adding for compartments E.7.2
- adding for groups E.7.3
- altering for compartments E.7.4
- altering for groups E.7.5
- compartments 3.3.1.2, 5.4.4
- dropping for all compartments E.7.6
- dropping for all groups E.7.7
- dropping for specified groups E.7.9
- groups 3.3.1.3, 5.4.6
- levels 3.3.1.1, 5.4.2
- removing all OLS privileges from user E.7.10
- row labels
  - default 3.3.1.3
- SA_USER_ADMIN.SET_USER_PRIVS procedure E.7.18
- understanding 3.3, 5.4.1
users
- finding label-specific information of F.1.2.12
- finding level-specific information of F.1.2.13
- finding policy-specific privileges of F.1.2.14
- finding privileges of OLS users F.1.2.11
- LBACSYS default user account 4.2
utilities
- SA_UTL package E.8.1

V

views
- access mediation 3.5.5
- ALL_SA_AUDIT_OPTIONS F.1.2.1
- ALL_SA_COMPARTMENTS F.1.2.2
- ALL_SA_GROUPS F.1.2.4
- ALL_SA_LABELS F.1.2.3, F.1.2.5
- ALL_SA_LEVELS F.1.2.6
- ALL_SA_POLICIES F.1.2.7
- ALL_SA_PROG_PRIVS F.1.2.8
- ALL_SA_SCHEMA_POLICIES F.1.2.9
- ALL_SA_TABLE_POLICIES F.1.2.10
- ALL_SA_USER_LABELS F.1.2.12
- ALL_SA_USER_LEVELS F.1.2.13
- ALL_SA_USER_PRIVS F.1.2.14
- ALL_SA_USERS F.1.2.11
- CDB_OLS_STATUS F.1.2.15
- DBA_OLS_STATUS F.1.2.33
- DBA_SA_AUDIT_OPTIONS F.1.2.16
- DBA_SA_COMPARTMENTS F.1.2.17
- DBA_SA_DATA_LABELS F.1.2.18
- DBA_SA_GROUP_HIERARCHY F.1.2.20
- DBA_SA_GROUPS F.1.2.19
- DBA_SA_LABELS F.1.2.21
- DBA_SA_LEVELS F.1.2.22
- DBA_SA_POLICIES F.1.2.23
- DBA_SA_PROG_PRIVS F.1.2.24
- DBA_SA_SCHEMA_POLICIES 8.1.11, F.1.2.25
- DBA_SA_TABLE_POLICIES 8.1.11, F.1.2.26
- DBA_SA_USER_COMPARTMENTS F.1.2.28
- DBA_SA_USER_GROUPS F.1.2.29
- DBA_SA_USER_LABELS F.1.2.30
- DBA_SA_USER_LEVELS F.1.2.31
- DBA_SA_USER_PRIVS F.1.2.32
- DBA_SA_USERS F.1.2.27

W

WRITE_CONTROL option
- algorithm 3.4.3
- definition 8.1.4
- introduction 8.1.7.2
- LABEL_UPDATE 8.1.7.2
- with INSERT, UPDATE, DELETE 8.1.7.2
- with other options 8.1.9
write access
- algorithm 3.4.3, 3.5.2.2
- introduction 3.4.1
WRITEACROSS privilege 3.5.3.3, 8.1.3, 8.1.6.3, 8.4.2
WRITEDOWN privilege 3.5.6, 8.1.3, 8.1.6.3, 8.4.2
write label 3.3.2
WRITEUP privilege 3.5.3, 3.5.3.1