Oracle VPD

Virtual Private Databases

! Virtual Private Database (VPD)
– Fine-grained access control: associate security policies to
database objects
– Application Context: define and access application or session
Elisa Bertino attributes

Purdue University
! Combining these two features, VPD enables
administrators to define and enforce row-level access
control policies based on session attributes.

Why VPD? Oracle VPD

! Scalability
– Table Customers contains 1,000 customer records. Suppose we want ! How does it work?
customers to access their own records only. Using views, we need to When a user accesses a table (or view or synonym) which is
create 1,000 views. Using VPD, it can be done with a single policy
function. protected by a VPD policy (function),

! Simplicity "
# The Oracle server invokes the policy function.
– Say, we have a table T and many views are based on T. Suppose we $# The policy function returns a predicate, based on session
want to restrict access to some information in T. Without VPD, all attributes or database contents.
view definitions have to be changed. Using VPD, it can be done by
attaching a policy function to T; as the policy is enforced in T, the %# The server dynamically rewrites the submitted query by
policy is also enforced for all the views that are based on T. appending the returned predicate to the WHERE clause.
&# The modified SQL query is executed.
! Security
– Server-enforced security (as opposed to application-enforced).
Oracle VPD: Example Oracle VPD: Example

! Suppose Alice has the following table. 1. Create a policy function

Create function sec_function(p_schema varchar2, p_obj varchar2)

my_table(owner varchar2(30), data varchar2(30)); Return varchar2
As
user VARCHAR2(100);
Begin
! Users can access only the data of their own. But Admin if ( SYS_CONTEXT(‘userenv’, ‘ISDBA’) ) then
should be able to access any data without restrictions. return ‘ ’;
else
user := SYS_CONTEXT(‘userenv’, ‘SESSION_USER’);
return ‘owner = ‘ || user;
end if;
End;

// userenv = the pre-defined application context

Oracle VPD: Example Oracle VPD-Example

2. Attach the policy function to my_table 3. Bob accesses my_table

select * from my_table;

execute dbms_rls.add_policy (object_schema => ‘Alice’, => select * from my_table where owner = ‘bob’;
object_name => ‘my_table’, : only shows the rows that owner is ‘bob’
policy_name => ‘my_policy’,
function_schema => ‘Alice’, insert into my_table values(‘Some data’, ‘bob’); OK!
policy_function => ‘sec_function’,
insert into my_table values(‘Other data’, ‘alice’); NOT OK!
statement_types => ‘select, update, insert’, = because of the check option.
update_check => TRUE );
Column-level VPD Column-level VPD: Example

! Instead of attaching a policy to a whole table or a view, ! Suppose Alice has the following table.
attach a policy only to security-relevant columns
Employees(e_id number(2), name varchar2(10), salary nubmer(3));
– Default behavior: restricts the number of rows returned by a
query. e_id Name Salary

– Masking behavior: returns all rows, but returns NULL values 1 Alice 80

for the columns that contain sensitive information. 2 Bob 60

3 Carl 99

! Restrictions ! Users can access e_id’s and names without any restriction. But users can
– Applies only to ‘select’ statements access only their own salary information.
– The predicate must be a simple boolean expression.

Column-level VPD: Example Column-level VPD: Example

1. Create a policy function 2. Attach the policy function to Employees (default behavior)

Create function sec_function(p_schema varchar2, p_obj varchar2)

Return varchar2 execute dbms_rls.add_policy (object_schema => ‘Alice’,
As object_name => ‘employees’,
user VARCHAR2(100); policy_name => ‘my_policy’,
Begin function_schema => ‘Alice’,
user := SYS_CONTEXT(‘userenv’, ‘SESSION_USER’);
policy_function => ‘sec_function’,
return ‘name = ‘ || user;
end if; sec_relevant_cols=>’salary’);
End;
Column-level VPD: Example Column-level VPD: Example

3. Bob accesses table Employees (default behavior) 2’. Attach the policy function to Employees (masking behavior)

select e_id, name from Employee; execute dbms_rls.add_policy (object_schema => ‘Alice’,
e_id Name object_name => ‘employees’,
1 Alice policy_name => ‘my_policy’,
2 Bob function_schema => ‘Alice’,
3 Carl policy_function => ‘sec_function’,
sec_relevant_cols=>’salary’,
select e_id, name, salary from Employee; sec_relevant_cols_opt=>dbms_rls.ALL_ROWS);

e_id Name Salary

2 Bob 60

Column-level VPD: Example Application Context

3. Bob accesses table Employees (masking behavior)

! Application contexts act as secure caches of data that may
select e_id, name from Employee;
be used by a fine-grained access control policy.
e_id Name
1 Alice – Upon logging into the database, Oracle sets up an application
2 Bob context in the user’s section.
3 Carl – You can define, set and access application attributes that you
can use as a secure data cache.
select e_id, name, salary from Employee;
e_id Name Salary ! There is a pre-defined application context, “userenv”.
1 Alice – See Page 13-12 in Oracle Security Guide.
2 Bob 60
3 Carl
Application Context Create Application Context

! One can create a customized application context and attributes. 1. Create a PL/SQL package that sets the context
– Say, each employee can access a portion of the Customers table, based
Create package Set_emp_env IS
on the job-position. procedure Set_job_position IS
– For example, a clerk can access only the records of the customers who jp varchar(100);
lives in a region assigned to him. But a manager can access any record. begin
select job_pos into jp from Employee
– Suppose that the job-positions of employees are stored in a LDAP
where name = SYS_CONTEXT(‘USERENV’, ‘SESSION_USER’);
server (or in the Employee table). DBMS_SESSION.SET_CONTEXT(‘emp_env’, ‘job’, jp);
– Such information can be accessed and cached in an application context end;
when an employee logs in. End;

! To set an attribute value in an application context, 2. Create a context and associate it with the package
– DBMS_SESSION.SET_CONTEXT(‘namespace’, ‘attributename’, value); Create Context emp_env Using Emp_env_context;
! To get an attribute value from an application context,
– Any attribute in the “emp_env” context can only be set by procedures in the
– SYS_CONTEXT(‘namespace’, ‘attributename’); “Emp_env_context” package.

Using Application Context Multiple Policies

! It is possible to associate multiple policies to a database object.

3. Set the context before users retrieve data (at the login)
– The policies are enforced with AND syntax.
Create or Replace Trigger Emp_trig – For example, suppose table T is associated with {P1, P2, P3}.
After Logon On Database – When T is accessed by query Q = select A from T where C.
Begin – Q’ = select A from T where C ! (c1 ! c2 ! c3).
Emp_env_context. Set_job_position
End
! Different from Stonebraker’s approach
– Use an event trigger on login to pull session information into the context.
– The policies are enforced with OR syntax.
4. Use the context in a VPD function – Q’ = select A from T where C ! (c1 " c2 " c3).

if (SYS_CONTEXT(’emp_env’, ’job’) = ‘manager’) ! While Stonebraker’s policies specify “what users can see” (permissions),
return ‘’; VPD policies specify “what users cannot see” (prohibitions).
else …
VPD Related Privileges Based-on Database Content
! Who can create VPD policies? That is, what privileges are needed to create a ! It is possible to define VPD policy functions without using the application
VPD policy on a database object? context. Instead, we can directly query the database content from the policy
– EXECUTE on the DBMS_RLS package to attach a policy to an object
! the package includes add_policy, drop_policy, enable_policy, and so on.
functions.
– CREATE PROCEDURE to create a policy function
Not absolutely necessary as you can use somebody else’s policy functions.
!
! Does not need to have any privilege on the policy functions.
! Alice: Employees(e_id number(2), name varchar2(10), salary number(2));
– Does not require any object privilege on the target objects unless you are defining the ! Bob: Values(p_id number(2), value number(2));
policy function (explained later).

! Who can create application contexts? ! Users can access the record of any employee whose salary is less than the
– CREATE ANY CONTEXT (there is no CREATE CONTEXT) maximum value in Values.
– CREATE PROCEDURE
– EXECUTE on the DBMS_SESSION package
– Privileges on the objects that the setup functions access.

! Two classes of users are exempt from VPD policies.

– SYS user is exempt by default.
– Users with the EXEMPT ACCESS POLICY system privilege.

Based-on Database Content Issue (1): Invoker’s right?

1. Create a policy function ! As previously mentioned, one can attach a policy function to a
create or replace function Policy_func (oowner in varchar2, ojname in varchar2) database object whether or not she has any privilege on the
return varchar2 function or the objects the function refers to.
as
cond varchar2(100);
mxv number; ! Then when the policy function is invoked, the function runs on
begin behalf of whom? The definer? The invoker?
select max(value) into mxv from Bob.Values; – If the function is defined as definer’s right, the answer is
cond := 'salary < ' || mxv; straightforward. The definer.
return (cond); – What if the function is defined as invoker’s right? Surprisingly, the
end ComplexPolicy; invoker’s right function still runs on behalf of the definer.
– However, if the policy function invokes an invoker’s right procedure,
2. Attach the function to Employee the procedure runs on behalf of the invoker.
execute dbms_rls.add_policy('alice', 'employees', ‘policy', ‘alice', ‘Policy_func', 'select'); – Not consistent at all.
Issue (2): Recursion Discussion

! “Note: Although you can define a policy against a table, you cannot ! VPD provides a very powerful access control.
select that table from within the policy that was defined against the
table.” (from Ch. 13 of Oracle Security Guide)
– That is, a policy function of an object should not access the object. ! It is difficult, if not impossible, to verify whether or not a
– Suppose that a policy function PF that protects a table T accesses T. particular user has access to a particular data item in a
– When T is accessed, PF is invoked. PF tries to access T, and another PF is particular table in a particular state.
invoked. This results in endless function invocations. – Such verification requires checking all policy functions.
– As policy functions are too “flexible”, it is computationally
! This cyclic invocation can occur in a longer chain. impossible to analyze them.
– For example, define a policy function for T, that accesses another table
T1. If T1 is protected by another policy function that refers to T, then
we have a cycle.
– It is hard to check. (A policy function can even invoke a C program.)
– Note that this problem can be avoided by using application context.

Virtual Private Databases

Question?