C Postinstallation Oracle Database Vault Procedures

After you register Oracle Database Vault, you can perform specialized tasks, such as configuring it on Oracle Real Application Clusters (Oracle RAC) nodes.

C.1 Configuring Oracle Database Vault on Oracle RAC Nodes

After you configure Oracle Database Vault for an Oracle Real Application Clusters (Oracle RAC) instance, you must configure each Oracle RAC node.

The following procedure assumes that you have a separate Oracle home for each node.

  1. Log into the PDB as user SYS with the SYSDBA administrative privilege.
    sqlplus sys@pdb_name as sysdba 
    Enter password: password
    

    To find the available PDBs, query the PDB_NAME column of the DBA_PDBS data dictionary view. To check the current container, run the show con_name command.

  2. Run the following ALTER SYSTEM statements on each Oracle RAC node:
    ALTER SYSTEM SET AUDIT_SYS_OPERATIONS=TRUE SCOPE=SPFILE; -- For non-unified auditing environments
    ALTER SYSTEM SET OS_ROLES=FALSE SCOPE=SPFILE; 
    ALTER SYSTEM SET RECYCLEBIN='OFF' SCOPE=SPFILE; 
    ALTER SYSTEM SET REMOTE_LOGIN_PASSWORDFILE='EXCLUSIVE' SCOPE=SPFILE;
    ALTER SYSTEM SET SQL92_SECURITY=TRUE SCOPE=SPFILE; 
    
  3. Close and then reopen the PDB.
    ALTER PLUGGABLE DATABASE pdb_name CLOSE IMMEDIATE;
    ALTER PLUGGABLE DATABASE pdb_name OPEN;

C.2 Adding Languages to Oracle Database Vault

By default, Oracle Database Vault loads only the English language tables.

You can add more languages by running the DBMS_MACADM.ADD_NLS_DATA procedure for each new language that you want to add. You can add more than one language to Database Vault, to either a specific PDB or to the root for all PDBs.

  1. Log into the root or the PDB as a user who has been granted the DV_OWNER or DV_ADMIN role.
  2. Run the following procedure:
    EXEC DBMS_MACADM.ADD_NLS_DATA('language');
    

    You can specify the language setting using any case. For example:

    EXEC DBMS_MACADM.ADD_NLS_DATA('french');
    
    EXEC DBMS_MACADM.ADD_NLS_DATA('JAPANESE');
    

    Replace language with one of the following supported languages:

    • ENGLISH

    • GERMAN

    • SPANISH

    • FRENCH

    • ITALIAN

    • JAPANESE

    • KOREAN

    • BRAZILIAN PORTUGUESE

    • SIMPLIFIED CHINESE

    • TRADITIONAL CHINESE

C.3 Uninstalling Oracle Database Vault

You can uninstall Oracle Database Vault from an Oracle Database installation, for PDBs (but not the root) and Oracle RAC installations.

The uninstallation process does not affect the initialization parameter settings, even those settings that were modified during the installation process, nor does it affect Oracle Label Security.

  1. Log into the PDB as user SYS with the SYSDBA administrative privilege.
    For example:
    sqlplus psmith@pdb_name
    Enter password: password
    
  2. Connect to the PDB as a user who has been granted the DV_OWNER or DV_ADMIN role.

    For example:

    CONNECT leo_dvowner@pdb_name
    Enter password: password
    
  3. Run the following procedure to disable Oracle Database Vault:
    EXEC DBMS_MACADM.DISABLE_DV;
    
  4. Close and reopen the PDB, or for Oracle RAC, restart the database.
    As a user who has the ALTER PLUGGABLE DATABASE privilege:
    ALTER PLUGGABLE DATABASE pdb_name CLOSE IMMEDIATE;
    ALTER PLUGGABLE DATABASE pdb_name OPEN;

    For Oracle RAC installations, shut down and then restart each database instance as follows:

    $ srvctl stop database -db db_name
    $ srvctl start database -db db_name
    
  5. Run the dvremov.sql script to remove Oracle Database Vault.

    For example:

    $ORACLE_HOME/rdbms/admin/dvremov.sql
    
  6. If necessary, in SQL*Plus, as user SYS with the SYSDBA administrative privilege, manually revoke the EXECUTE privilege on the DBMS_RLS PL/SQL package from any users who have been granted the DV_OWNER role.
    When you configure Oracle Database Vault, one of the privileges that DV_OWNERusers are granted is this privilege. However, when you remove Oracle Database Vault, DV_OWNER users still have this privilege. Optionally, you can revoke it.
    REVOKE EXECUTE ON DBMS_RLS FROM dbv_owner_backup;

Afterward, you can double-check that Oracle Database Vault is truly deinstalled by logging in to SQL*Plus and entering the following statement:

SELECT * FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault';

If Oracle Database Vault is deinstalled, the following output appears:

PARAMETER                     VALUE
----------------------------- -----------------------
Oracle Database Vault         FALSE

C.4 Reinstalling Oracle Database Vault

You can reinstall Oracle Database Vault by manually installing it, and then afterward, registering it.