16 Oracle Database Vault Command Rule APIs
The DBMS_MACADM
PL/SQL package provides procedures for configuring command rules. .
Only users who have been granted the DV_OWNER
or DV_ADMIN
role can use these procedures.
- CREATE_COMMAND_RULE Procedure
TheCREATE_COMMAND_RULE
procedure creates both command and local command rules, which can be added to a rule set. - CREATE_CONNECT_COMMAND_RULE Procedure
TheCREATE_CONNECT_COMMAND_RULE
procedure creates both common and local CONNECT command rules that you can associate with a user and a rule set. - CREATE_SESSION_EVENT_CMD_RULE Procedure
TheCREATE_SESSION_EVENT_CMD_RULE
procedure creates both common and local command rules that you can associate with session events, based on theALTER SESSION
statement. - CREATE_SYSTEM_EVENT_CMD_RULE Procedure
TheCREATE_SYSTEM_EVENT_CMD_RULE
procedure creates both command and local command rules that you can associate with system events, based on theALTER SYSTEM
statement. - DELETE_COMMAND_RULE Procedure
TheDELETE_COMMAND_RULE
procedure drops a command rule declaration. - DELETE_CONNECT_COMMAND_RULE Procedure
TheDELETE_CONNECT_COMMAND_RULE
procedure deletes aCONNECT
command rule that had been created with theCREATE_CONNECT_COMMAND_RULE
procedure. - DELETE_SESSION_EVENT_CMD_RULE Procedure
TheDELETE_SESSION_EVENT_CMD_RULE
procedure deletes a session command rule that was associated with events. - DELETE_SYSTEM_EVENT_CMD_RULE Procedure
TheDELETE_SYSTEM_EVENT_CMD_RULE
procedure deletes a system command rule that was associated with events. - UPDATE_COMMAND_RULE Procedure
TheUPDATE_COMMAND_RULE
procedure updates the command rule declaration for both common and local command rules. - UPDATE_CONNECT_COMMAND_RULE Procedure
TheUPDATE_CONNECT_COMMAND_RULE
procedure updates aCONNECT
command rule that had been created with theCREATE_CONNECT_COMMAND_RULE
procedure. - UPDATE_SESSION_EVENT_CMD_RULE Procedure
TheUPDATE_SESSION_EVENT_CMD_RULE
procedure updates both common and local session event command rules, based on theALTER SESSION
statement. - UPDATE_SYSTEM_EVENT_CMD_RULE Procedure
TheUPDATE_SYSTEM_EVENT_CMD_RULE
procedure updates both common and local system event command rules, based on theALTER SYSTEM
statement.
Related Topics
16.1 CREATE_COMMAND_RULE Procedure
The CREATE_COMMAND_RULE
procedure creates both command and local command rules, which can be added to a rule set.
Optionally, you can use it to enable the command rule for rule checking with a rule set.
Syntax
DBMS_MACADM.CREATE_COMMAND_RULE( command IN VARCHAR2, rule_set_name IN VARCHAR2, object_owner IN VARCHAR2, object_name IN VARCHAR2, enabled IN VARCHAR2 DEFAULT, privilege_scope IN NUMBER DEFAULT, clause_name IN VARCHAR2 DEFAULT, parameter_name IN VARCHAR2 DEFAULT, event_name IN VARCHAR2 DEFAULT, component_name IN VARCHAR2 DEFAULT, action_name IN VARCHAR2 DEFAULT, scope IN NUMBER DEFAULT, pl_sql_stack IN BOOLEAN DEFAULT;
Parameters
Table 16-1 CREATE_COMMAND_RULE Parameters
Parameter | Description |
---|---|
|
SQL statement to protect. To find existing command rules, query the If you plan to create a command rule for a unified audit policy object, then ensure that you specify If you want to create a command rule for the |
|
Name of rule set to associate with this command rule. To find existing rule sets in the current database instance, query the |
|
Database schema to which this command rule will apply. To find the available schema users, query the The wildcard The wildcard |
|
Object to be protected by the command rule. The wildcard % is allowed. Specify To find the available objects, query the |
|
Controls the enablement of the command rule. If you omit this setting, then it defaults to
|
|
Obsolete parameter, |
|
A clause from the SQL statement that was used to create the command rule. For example, a command rule for the Applies only to command rules for The default is |
|
A parameter from the Applies only to command rules for The default is |
|
An event that the command rule defines. For example, suppose an Applies only to The default is |
|
A component of the Applies only to The default is |
|
An action of the Applies only to The default is |
|
Determines how to execute this procedure. If you omit this setting, then it defaults to
If you create the common command rule in an application root and want it visible to the associated PDBs, then you must synchronize the application. For example: ALTER PLUGGABLE DATABASE APPLICATION saas_sales_app SYNC; |
|
When simulation mode is enabled, specifies whether to record the PL/SQL stack for failed operations.
|
ALTER SYSTEM Command Rule Settings
Table 16-2 describes the ALTER SYSTEM
command rule settings.
Table 16-2 ALTER SYSTEM Command Rule Settings
clause_name | parameter_name — Parameter Value |
---|---|
|
|
|
N/A — |
|
N/A — |
|
N/A — N/A |
|
N/A — |
|
|
|
|
|
|
|
|
|
|
|
N/A — N/A |
|
|
|
N/A — N/A |
|
|
|
|
|
N/A — |
|
N/A — |
|
N/A — N/A |
|
N/A — |
ALTER SESSION Command Rule Settings
Table 16-3 describes the ALTER SESSION
command rule settings.
Table 16-3 ALTER SESSION Command Rule Settings
clause_name | parameter_name — Parameter Value |
---|---|
|
N/A — |
|
N/A — |
|
N/A — |
|
N/A — |
|
|
|
N/A — N/A |
|
N/A — |
|
N/A — |
|
N/A — |
|
N/A — |
|
N/A — N/A |
|
|
Examples
Simple Command Rules
The following example shows how to create a simple command rule for the SELECT
statement on the HR.EMPLOYEEES
table. This command rule uses a custom rule set called Check User Role
. This rule set must exist before the command rule can be created.
BEGIN DBMS_MACADM.CREATE_COMMAND_RULE( command => 'SELECT', rule_set_name => 'Check User Role', object_owner => 'HR', object_name => 'EMPLOYEES', enabled => DBMS_MACUTL.G_YES); END; /
This example shows how to create a command rule that checks if users can enable or disable the hr_app_aud_pol
unified audit policy. The enabled
parameter is omitted so that it can default to DBMS_MACUTL.G_YES
. Note that if the object is a unified audit policy, then you must have AUDIT POLICY
, not AUDIT
, for the command
parameter.
BEGIN DBMS_MACADM.CREATE_COMMAND_RULE( command => 'AUDIT POLICY', rule_set_name => 'Check ability to audit', object_owner => '%', object_name => 'hr_app_aud_pol', scope => DBMS_MACUTL.G_SCOPE_LOCAL); END; /
ALTER SESSION Command Rule Using the SET Clause
The following example shows how to create an ALTER SESSION
command rule that uses the SET
clause with the ERROR_ON_OVERLAP_TIME
parameter.
BEGIN DBMS_MACADM.CREATE_COMMAND_RULE( command => 'ALTER SESSION', rule_set_name => 'Test ERROR_ON_OVERLAP_TIME for FALSE', object_owner => '%', object_name => '%', enabled => DBMS_MACUTL.G_NO, clause_name => 'SET', parameter_name => 'ERROR_ON_OVERLAP_TIME', scope => DBMS_MACUTL.G_SCOPE_LOCAL); END; /
In this example:
-
rule_set_name
: TheALTER SESSION
SQL statementERROR_ON_OVERLAP_TIME
session parameter must be set to eitherTRUE
orFALSE
. You can create a rule set that checks if this setting. For example, for the rule:EXEC DBMS_MACADM.CREATE_RULE('RULE_TRUE', 'UPPER(PARAMETER_VALUE) = ''TRUE''');
The rule set that is used with this rule can be similar to the following:
BEGIN DBMS_MACADM.CREATE_RULE_SET( rule_set_name => 'Test ERROR_ON_OVERLAP_TIME', description => 'Checks if the ERROR_ON_OVERLAP_TIME setting is TRUE or FALSE', enabled => DBMS_MACUTL.G_YES, eval_options => DBMS_MACUTL.G_RULESET_EVAL_ALL, audit_options => DBMS_MACUTL.G_RULESET_AUDIT_OFF, fail_options => DBMS_MACUTL.G_RULESET_FAIL_SILENT, fail_message => 'false error on overlaptime', fail_code => 20461, handler_options => DBMS_MACUTL.G_RULESET_HANDLER_FAIL, handler => '', is_static => false); END; / EXEC DBMS_MACADM.ADD_RULE_TO_RULE_SET('Test ERROR_ON_OVERLAP_TIME', 'RULE_TRUE');
-
object_owner
andobject_name
must be set to%
forALTER SESSION
andALTER SYSTEM
command rules. -
enabled
uses theDBMS_MACUTL.G_NO
constant to disable the command rule when it is created. -
clause_name
sets theALTER SESSION
command rule to use theSET
clause of theALTER SESSION
PL/SQL statement. -
parameter_name
is set to theERROR_ON_OVERLAP_TIME
parameter of theSET
clause. -
scope
uses theDBMS_MACUTL.G_SCOPE_COMMON
constant to set the command rule to be a common command rule. This command rule will be in the application root of a multitenant environment, so the user running this procedure must be in the CDB root. Any rules or rule sets that are associated with this command rule must be common.If you were creating the command rule locally, you would set
scope
toDBMS_MACUTL.G_SCOPE_LOCAL
. In that case, the user who runs this procedure must be in the PDB in which the command rule will reside. To find the existing PDBs, you can query theDBA_PDBS
data dictionary view. Any rules or rule sets that are associated with this command rule must be local.
ALTER SYSTEM Command Rule Using the CHECKPOINT Clause
This example shows how to create an ALTER SYSTEM command rule that users the CHECKPOINT
clause. To have the command rule test for the CHECKPOINT
setting, you must create a rule set and rule, similar to the ALTER SESSION command rule in the previous example. In this example, the parameter
setting is not specified because the CHECKPOINT
setting does not have parameters.
BEGIN DBMS_MACADM.CREATE_COMMAND_RULE( command => 'ALTER SYSTEM', rule_set_name => 'Test CHECKPOINT Setting', object_owner => '%', object_name => '%', enabled => DBMS_MACUTL.G_YES, clause_name => 'CHECKPOINT', parameter_name => '', scope => DBMS_MACUTL.G_SCOPE_LOCAL); END; /
ALTER SESSION Command Rule Using the SET Clause
The following ALTER SESSION command rule uses the SET
clause to specify an event_name
and component_name
. You can only use the event_name
, component_name
, and action_name
parameters if the clause_name
parameter specifies SET
.
BEGIN DBMS_MACADM.CREATE_COMMAND_RULE( command => 'ALTER SESSION', rule_set_name => 'Check Trace Events', object_owner => '%', object_name => '%', enabled => DBMS_MACUTL.G_YES, clause_name => 'SET', parameter_name => 'EVENTS', event_name => 'TRACE', component_name => 'GCS', scope => DBMS_MACUTL.G_SCOPE_LOCAL); END; /
16.2 CREATE_CONNECT_COMMAND_RULE Procedure
The CREATE_CONNECT_COMMAND_RULE
procedure creates both common and local CONNECT command rules that you can associate with a user and a rule set.
Syntax
DBMS_MACADM.CREATE_CONNECT_COMMAND_RULE( user_name IN VARCHAR2, rule_set_name IN VARCHAR2, enabled IN VARCHAR2 DEFAULT, scope IN NUMBER DEFAULT);
Parameters
Table 16-4 CREATE_CONNECT_COMMAND_RULE Parameters
Parameter | Description |
---|---|
|
User to whom the CONNECT command rule will apply. If you enter the If you run this procedure in the root, then specifying Ensure that this user is common if the CONNECT command rule is common, and local or common if the CONNECT command rule is local. To find existing database users in the current instance, query the |
|
Name of rule set to associate with this command rule. Ensure that this rule set is common if the CONNECT command rule is common, and local if the CONNECT command rule is local. To find existing rule sets in the current database instance, query the |
|
Controls the enablement of the connect command rule. If you omit this setting, then it defaults to
|
|
Determines how to execute this procedure. If you omit this setting, then it defaults to
If you create the common CONNECT command rule in an application root and want it visible to the associated PDBs, then you must synchronize the application. For example: ALTER PLUGGABLE DATABASE APPLICATION saas_sales_app SYNC; |
Examples
The following example shows how to create a common CONNECT command rule. This command rule will be in the CDB root, so the user who runs this procedure must be in the CDB root. Any user names or rule sets that are associated with this command rule must be common.
BEGIN DBMS_MACADM.CREATE_CONNECT_COMMAND_RULE( rule_set_name => 'Allow Sessions', user_name => 'C##HR_ADMIN', enabled => DBMS_MACUTL.G_SIMULATION, scope => DBMS_MACUTL.G_SCOPE_COMMON); END; /
This example is a local version of the preceding example. The user who runs this procedure must be in the PDB in which the local CONNECT command rule will reside. To find the available PDBs, run the show pdbs
command. Any rule sets that are associated with this command rule must be local. The user can be either common or local.
BEGIN DBMS_MACADM.CREATE_CONNECT_COMMAND_RULE( rule_set_name => 'Allow Sessions', user_name => 'PSMITH', enabled => DBMS_MACUTL.G_SIMULATION, scope => DBMS_MACUTL.G_SCOPE_LOCAL); END; /
Parent topic: Oracle Database Vault Command Rule APIs
16.3 CREATE_SESSION_EVENT_CMD_RULE Procedure
The CREATE_SESSION_EVENT_CMD_RULE
procedure creates both common and local command rules that you can associate with session events, based on the ALTER SESSION
statement.
Syntax
DBMS_MACADM.CREATE_SESSION_EVENT_CMD_RULE( rule_set_name IN VARCHAR2, enabled IN VARCHAR2 DEFAULT, event_name IN VARCHAR2 DEFAULT, component_name IN VARCHAR2 DEFAULT, action_name IN VARCHAR2 DEFAULT, scope IN NUMBER DEFAULT, pl_sql_stack IN BOOLEAN DEFAULT);
Parameters
Table 16-5 CREATE_SESSION_EVENT_CMD_RULE Parameters
Parameter | Description |
---|---|
|
Name of the rule set to associate with the command rule. Ensure that this rule set is common if the session event command rule is common, and local if the command rule is local. To find existing rule sets in the current database instance, query the |
|
Controls the enablement of the session event command rule. If you omit this setting, then it defaults to
|
|
An event that the command rule defines. This setting enables the command rule to correspond with an The default is |
|
A component of the You can find valid component names by issuing The default is |
|
An action of the The default is |
|
Determines how to execute this procedure. If you omit this setting, then it defaults to
If you create the common command rule in an application root and want it visible to the associated PDBs, then you must synchronize the application. For example: ALTER PLUGGABLE DATABASE APPLICATION saas_sales_app SYNC; |
|
When simulation mode is enabled, specifies whether to record the PL/SQL stack for failed operations.
|
Examples
The following example shows how to create a common session event command rule in a multitenant environment. This command rule will be in the application root, so the user running this procedure must be in the CDB root. Any user names or rule sets that are associated with this command rule must be common.
BEGIN DBMS_MACADM.CREATE_SESSION_EVENT_CMD_RULE( rule_set_name => 'Allow Sessions', event_name => 'TRACE', component_name => 'DV', action_name => 'CURSORTRACE', enabled => DBMS_MACUTL.G_SIMULATION, scope => DBMS_MACUTL.G_SCOPE_COMMON); END; /
This example shows how to create a session event for the 47998 trace event. In this example, enabled
is omitted so that its default, DBMS_MACUTL.G_YES
, will be used. This example will records the PL/SQL stack for failed operations.
BEGIN DBMS_MACADM.CREATE_SESSION_EVENT_CMD_RULE( rule_set_name => 'Allow Sessions', event_name => '47998', scope => DBMS_MACUTL.G_SCOPE_LOCAL, pl_sql_stack => TRUE); END; /
Parent topic: Oracle Database Vault Command Rule APIs
16.4 CREATE_SYSTEM_EVENT_CMD_RULE Procedure
The CREATE_SYSTEM_EVENT_CMD_RULE
procedure creates both command and local command rules that you can associate with system events, based on the ALTER SYSTEM
statement.
Syntax
DBMS_MACADM.CREATE_SYSTEM_EVENT_CMD_RULE( rule_set_name IN VARCHAR2, enabled IN VARCHAR2 DEFAULT, event_name IN VARCHAR2 DEFAULT, component_name IN VARCHAR2 DEFAULT, action_name IN VARCHAR2 DEFAULT, scope IN NUMBER DEFAULT, pl_sql_stack IN BOOLEAN DEFAULT);
Parameters
Table 16-6 CREATE_SYSTEM_EVENT_CMD_RULE Parameters
Parameter | Description |
---|---|
|
Name of the rule set to associate with the command rule. Ensure that this rule set is common if the system event command rule is common, and local if the command rule is local. To find existing rule sets in the current database instance, query the |
|
An event that the command rule defines. This setting enables the command rule to correspond to an The default is |
|
A component of the You can find valid component names by issuing The default is |
|
An action of the The default is |
|
Controls the enablement of the system event command rule. If you omit this setting, then it defaults to
|
|
Determines how to execute this procedure. If you omit this setting, then it defaults to
If you create the common command rule in an application root and want it visible to the associated PDBs, then you must synchronize the application. For example: ALTER PLUGGABLE DATABASE APPLICATION saas_sales_app SYNC; |
|
When simulation mode is enabled, specifies whether to record the PL/SQL stack for failed operations. Enter |
Example
The following example shows how to create a common system event command rule in a multitenant environment. This command rule will be in the application root, so the user running this procedure must be in the CDB root. Any user names or rule sets that are associated with this command rule must be common.
BEGIN DBMS_MACADM.CREATE_SYSTEM_EVENT_CMD_RULE( rule_set_name => 'Enabled', event_name => 'TRACE', component_name => 'GSIPC', action_name => 'HEAPDUMP', enabled => DBMS_MACUTL.G_NO, scope => DBMS_MACUTL.G_SCOPE_COMMON); END; /
Parent topic: Oracle Database Vault Command Rule APIs
16.5 DELETE_COMMAND_RULE Procedure
The DELETE_COMMAND_RULE
procedure drops a command rule declaration.
Syntax
DBMS_MACADM.DELETE_COMMAND_RULE( command IN VARCHAR2, object_owner IN VARCHAR2, object_name IN VARCHAR2, clause_name IN VARCHAR2 DEFAULT, parameter_name IN VARCHAR2 DEFAULT, event_name IN VARCHAR2 DEFAULT, component_name IN VARCHAR2 DEFAULT, action_name IN VARCHAR2 DEFAULT, scope IN NUMBER DEFAULT);
Parameters
Table 16-7 DELETE_COMMAND_RULE Parameters
Parameter | Description |
---|---|
|
SQL statement the command rule protects. To find available command rules, query the |
|
Database schema to which this command rule applies. To find the available users in the current database instance, query the |
|
Object name. The wildcard To find the available objects in the current database instance, query the |
|
A clause from the SQL statement that was used to create the command rule. Applies only to command rules for The default is |
|
A parameter from the Applies only to command rules for The default is |
|
An event that the command rule defines. Applies only to command rules for The default is |
|
A component of the Applies only to command rules for The default is |
|
An action of the Applies only to command rules for The default is |
|
Determines how to execute this procedure. The default is local. Options are as follows:
|
Examples
When you drop a command rule, you must omit the rule_set_name
and enabled
parameters, and ensure that the rest of the parameters match the settings that were used the last time the command rule was updated. You can check the most recent settings by querying the DBA_DV_COMMAND_RULE
data dictionary view.
For example, suppose you created the following command rule:
BEGIN DBMS_MACADM.CREATE_COMMAND_RULE( command => 'SELECT', rule_set_name => 'Enabled', object_owner => 'OE', object_name => 'ORDERS', enabled => DBMS_MACUTL.G_YES, scope => DBMS_MACUTL.G_SCOPE_LOCAL); END; /
To drop this command rule, use the most of same parameters as shown here, but omit rule_set_name
and enabled
.
BEGIN DBMS_MACADM.DELETE_COMMAND_RULE( command => 'SELECT', object_owner => 'OE', object_name => 'ORDERS', scope => DBMS_MACUTL.G_SCOPE_LOCAL); END; /
The following example shows how to delete an ALTER SESSION
command rule.
BEGIN DBMS_MACADM.DELETE_COMMAND_RULE( command => 'ALTER SESSION', object_owner => '%', object_name => '%', clause_name => 'SET', parameter_name => 'EVENTS', event_name => 'TRACE', component_name => 'GCS', scope => DBMS_MACUTL.G_SCOPE_LOCAL); END; /
Related Topics
Parent topic: Oracle Database Vault Command Rule APIs
16.6 DELETE_CONNECT_COMMAND_RULE Procedure
The DELETE_CONNECT_COMMAND_RULE
procedure deletes a CONNECT
command rule that had been created with the CREATE_CONNECT_COMMAND_RULE
procedure.
Syntax
DBMS_MACADM.DELETE_CONNECT_COMMAND_RULE( user_name IN VARCHAR2, scope IN NUMBER DEFAULT);
Parameters
Table 16-8 DELETE_CONNECT_COMMAND_RULE Parameters
Parameter | Description |
---|---|
|
User to whom the To find this user, query the |
|
Determines how to execute this procedure. The default is local. Options are as follows:
|
Example
BEGIN DBMS_MACADM.DELETE_CONNECT_COMMAND_RULE( user_name => 'PSMITH', scope => DBMS_MACUTL.G_SCOPE_LOCAL); END; /
Parent topic: Oracle Database Vault Command Rule APIs
16.7 DELETE_SESSION_EVENT_CMD_RULE Procedure
The DELETE_SESSION_EVENT_CMD_RULE
procedure deletes a session command rule that was associated with events.
Syntax
DBMS_MACADM.DELETE_SESSION_EVENT_CMD_RULE( event_name IN VARCHAR2 DEFAULT, component_name IN VARCHAR2 DEFAULT, action_name IN VARCHAR2 DEFAULT, scope IN NUMBER DEFAULT);
Parameters
Table 16-9 DELETE_SESSION_EVENT_CMD_RULE Parameters
Parameter | Description |
---|---|
|
An event that the session event command rule defines. The The default is |
|
A component of the The default is |
|
An action of the The default is |
|
Determines how to execute this procedure. Options are as follows:
|
Example
The following example shows how to delete a common session event command rule in the application root a multitenant environment. The user running this procedure must be a common user in the CDB root. When you specify the parameters, ensure that they match exactly the parameters that were used the last time the command rule was updated. To find the current settings of the command rule, query the DBA_DV_COMMAND_RULE
view.
BEGIN DBMS_MACADM.DELETE_SESSION_EVENT_CMD_RULE( event_name => '47999', scope => DBMS_MACUTL.G_SCOPE_COMMON); END; /
Parent topic: Oracle Database Vault Command Rule APIs
16.8 DELETE_SYSTEM_EVENT_CMD_RULE Procedure
The DELETE_SYSTEM_EVENT_CMD_RULE
procedure deletes a system command rule that was associated with events.
Syntax
DBMS_MACADM.DELETE_SYSTEM_EVENT_CMD_RULE( event_name IN VARCHAR2 DEFAULT, component_name IN VARCHAR2 DEFAULT, action_name IN VARCHAR2 DEFAULT, scope IN NUMBER DEFAULT);
Parameters
Table 16-10 DELETE_SYSTEM_EVENT_CMD_RULE Parameters
Parameter | Description |
---|---|
|
An event that the system event command rule defines. The The default is |
|
A component of the The default is |
|
An action of the The default is |
|
Determines how to execute this procedure. Options are as follows:
|
Examples
The following example shows how to delete a common system event command rule in the application root. The user running this procedure must be a common user in the CDB root. When you specify the parameters, ensure that they match exactly the parameters that were used the last time the command rule was updated. To find the current settings of the command rule, query the DBA_DV_COMMAND_RULE
view.
BEGIN DBMS_MACADM.DELETE_SYSTEM_EVENT_CMD_RULE( event_name => 'TRACE', component_name => 'DV', action_name => '', scope => DBMS_MACUTL.G_SCOPE_COMMON); END; /
Parent topic: Oracle Database Vault Command Rule APIs
16.9 UPDATE_COMMAND_RULE Procedure
The UPDATE_COMMAND_RULE
procedure updates the command rule declaration for both common and local command rules.
Syntax
DBMS_MACADM.UPDATE_COMMAND_RULE( command IN VARCHAR2, rule_set_name IN VARCHAR2 DEFAULT, object_owner IN VARCHAR2, object_name IN VARCHAR2, enabled IN VARCHAR2 DEFAULT, privilege_scope IN NUMBER DEFAULT, clause_name IN VARCHAR2 DEFAULT, parameter_name IN VARCHAR2 DEFAULT, event_name IN VARCHAR2 DEFAULT, component_name IN VARCHAR2 DEFAULT, action_name IN VARCHAR2 DEFAULT, scope IN NUMBER DEFAULT, pl_sql_stack IN BOOLEAN DEFAULT);
Parameters
Table 16-11 UPDATE_COMMAND_RULE Parameters
Parameter | Description |
---|---|
|
Command rule to update See also Related Topics. |
|
Name of rule set to associate with this command rule. If you do not want to change this setting, then omit it or set it to To find existing rule sets in the current database instance, query the |
|
Database schema to which this command rule applies. To find the available users, query the |
|
Object name. (The wildcard % is allowed. See also Related Topic on creating a command rule for more details about object names. To find the available objects, query the |
|
Sets the status of the command rule. If you do not want to change this setting, then omit it or set it to
|
|
Obsolete parameter, |
|
A clause from the SQL statement that was used to create the command rule. For example, a command rule for the Applies only to command rules for The command rule settings for these two statements are described in the The default is |
|
A parameter from the Applies only to command rules for The default is |
|
An event that the command rule defines. For example, for an Applies only to The default is |
|
A component of the Applies only to The default is |
|
An action of the Applies only to The default is |
|
Determines whether the command rule to be updated is a local command rule or a common command rule. The possible settings are:
This parameter is not for update, that is, you cannot switch a command rule from If you update the common command rule in an application root and want it visible to the associated PDBs, then you must synchronize the application. For example: ALTER PLUGGABLE DATABASE APPLICATION saas_sales_app SYNC; |
|
When simulation mode is enabled, specifies whether to record the PL/SQL stack for failed operations. If you do not want to change this setting, then omit it or set it to
|
Examples
The following example shows how to update a simple command rule that protects the HR.EMPLOYEES
schema (for example, changing its rule set).
BEGIN DBMS_MACADM.UPDATE_COMMAND_RULE( command => 'SELECT', rule_set_name => 'Disabled', object_owner => 'HR', object_name => 'EMPLOYEES', enabled => DBMS_MACUTL.G_SIMULATION, scope => DBMS_MACUTL.G_SCOPE_LOCAL); END; /
This example shows how to update a more complex command rule, which is based on the ALTER SESSION
SQL statement. The enabled
parameter is omitted so that its previous value can be used.
BEGIN DBMS_MACADM.UPDATE_COMMAND_RULE( command => 'ALTER SESSION', rule_set_name => 'Enabled', object_owner => '%', object_name => '%', clause_name => 'SET', parameter_name => 'EVENTS', event_name => 'TRACE', component_name => 'GCS', scope => DBMS_MACUTL.G_SCOPE_LOCAL); END; /
16.10 UPDATE_CONNECT_COMMAND_RULE Procedure
The UPDATE_CONNECT_COMMAND_RULE
procedure updates a CONNECT
command rule that had been created with the CREATE_CONNECT_COMMAND_RULE
procedure.
Syntax
DBMS_MACADM.UPDATE_CONNECT_COMMAND_RULE( user_name IN VARCHAR2, rule_set_name IN VARCHAR2 DEFAULT, enabled IN VARCHAR2 DEFAULT, scope IN NUMBER DEFAULT);
Parameters
Table 16-12 UPDATE_CONNECT_COMMAND_RULE Parameters
Parameter | Description |
---|---|
|
User to whom the If you run this procedure in the root, then specifying Environment, ensure that this user is common if the To find existing command rules, query the To find existing database users in the current instance, query the |
|
Name of rule set to associate with this command rule. If you do not want to change this setting, then omit it or set it to Ensure that this rule set is common if the To find existing rule sets in the current database instance, query the |
|
Controls the enablement of the command rule. If you do not want to change this setting, then omit it or set it to
|
|
Determines whether the command rule to be updated is a local command rule or a common command rule.
This parameter is not for update, that is, you cannot switch a command rule from If you update the common command rule in an application root and want it visible to the associated PDBs, then you must synchronize the application. For example: ALTER PLUGGABLE DATABASE APPLICATION saas_sales_app SYNC; |
Example
In this example, enabled
is omitted because this setting did not need to change.
BEGIN DBMS_MACADM.UPDATE_CONNECT_COMMAND_RULE( rule_set_name => 'Allow Sessions', user_name => 'PSMITH', scope => DBMS_MACUTL.G_SCOPE_LOCAL); END; /
Parent topic: Oracle Database Vault Command Rule APIs
16.11 UPDATE_SESSION_EVENT_CMD_RULE Procedure
The UPDATE_SESSION_EVENT_CMD_RULE
procedure updates both common and local session event command rules, based on the ALTER SESSION
statement.
Syntax
DBMS_MACADM.UPDATE_SESSION_EVENT_CMD_RULE( rule_set_name IN VARCHAR2 DEFAULT, enabled IN VARCHAR2 DEFAULT, event_name IN VARCHAR2 DEFAULT, component_name IN VARCHAR2 DEFAULT, action_name IN VARCHAR2 DEFAULT, scope IN NUMBER DEFAULT, pl_sql_stack IN BOOLEAN DEFAULT);
Parameters
Table 16-13 UPDATE_SESSION_EVENT_CMD_RULE Parameters
Parameter | Description |
---|---|
|
Name of the rule set to associate with the command rule. If you do not want to change this setting, then omit it or set it to Ensure that this rule set is common if the session event command rule is common, and local if the command rule is local. To find existing rule sets in the current database instance, query the |
|
Controls the enablement of the session event command rule. If you do not want to change this setting, then omit it or set it to
|
|
An event that the command rule defines. This setting enables the command rule to correspond with an The default is |
|
A component of the You can find valid component names by issuing The default is |
|
An action of the The default is |
|
Determines whether the command rule to be updated is a local command rule or a common command rule.
This parameter is not for update, that is, you cannot switch a command rule from If you update the common command rule in an application root and want it visible to the associated PDBs, then you must synchronize the application. For example: ALTER PLUGGABLE DATABASE APPLICATION saas_sales_app SYNC; |
|
When simulation mode is enabled, specifies whether to record the PL/SQL stack for failed operations. If you do not want to change this setting, then omit it or set it to
|
Example
The following example shows how to update a common session event command rule. In this example, rule_set_name
is omitted because the rule set associated with this command rule does not need to be changed. This command rule is in the application root, so the user running this procedure must be in the CDB root. Any user names or rule sets that are associated with this command rule must be common.
BEGIN DBMS_MACADM.UPDATE_SESSION_EVENT_CMD_RULE( event_name => '47999', enabled => DBMS_MACUTL.G_NO, scope => DBMS_MACUTL.G_SCOPE_COMMON); END; /
Parent topic: Oracle Database Vault Command Rule APIs
16.12 UPDATE_SYSTEM_EVENT_CMD_RULE Procedure
The UPDATE_SYSTEM_EVENT_CMD_RULE
procedure updates both common and local system event command rules, based on the ALTER SYSTEM
statement.
Syntax
DBMS_MACADM.UPDATE_SYSTEM_EVENT_CMD_RULE( rule_set_name IN VARCHAR2 DEFAULT, enabled IN VARCHAR2 DEFAULT, event_name IN VARCHAR2 DEFAULT, component_name IN VARCHAR2 DEFAULT, action_name IN VARCHAR2 DEFAULT, scope IN NUMBER DEFAULT, pl_sql_stack IN BOOLEAN DEFAULT);
Parameters
Table 16-14 UPDATE_SYSTEM_EVENT_CMD_RULE Parameters
Parameter | Description |
---|---|
|
Name of the rule set to associate with the command rule. If you do not want to change this setting, then omit it or set it to Ensure that this rule set is common if the system event command rule is common, and local if the command rule is local. To find existing rule sets in the current database instance, query the |
|
Controls the enablement of the system event command rule. If you do not want to change this setting, then omit it or set it to
|
|
An event that the command rule defines. This setting enables the command rule to correspond to an The default is |
|
A component of the You can find valid component names by issuing The default is |
|
An action of the The default is |
|
Determines whether the command rule to be updated is a local command rule or a common command rule.
This parameter is not for update, that is, you cannot switch a command rule from If you update the common command rule in an application root and want it visible to the associated PDBs, then you must synchronize the application. For example: ALTER PLUGGABLE DATABASE APPLICATION saas_sales_app SYNC; |
|
When simulation mode is enabled, specifies whether to record the PL/SQL stack for failed operations. If you do not want to change this setting, then omit it or set it to
|
Example
The following example shows how to update a common system event command rule. This command rule is in the application root, so the user running this procedure must be in the CDB root. Any user names or rule sets that are associated with this command rule must be common.
BEGIN DBMS_MACADM.UPDATE_SYSTEM_EVENT_CMD_RULE( rule_set_name => 'Disabled', event_name => 'TRACE', component_name => 'DV', enabled => 'n', scope => DBMS_MACUTL.G_SCOPE_COMMON); END; /
Parent topic: Oracle Database Vault Command Rule APIs