Oracle Label Security

Oracle Label Security (OLS) is a feature provided by Oracle Database that enables the implementation of fine-grained access control policies based on data labels. It is designed to enhance data security by enforcing data confidentiality and access restrictions at a more granular level.

OLS operates by assigning security labels to rows in database tables, as well as to individual columns or specific portions of data. These labels categorize data based on sensitivity, classification, or any other criteria relevant to the organization's security requirements. Examples of labels could include "Confidential," "Internal Use Only," or "Public."

With OLS, administrators can define security policies that control access to data based on these labels. The policies can specify which users or roles are allowed to view, modify, or delete data with specific labels. This fine-grained access control ensures that only authorized individuals or groups can access sensitive or classified information, providing an additional layer of data protection.

-- Create the "Documents" table

CREATE TABLE Documents (
  DocumentID     NUMBER,
  DocumentName   VARCHAR2(100),
  Classification VARCHAR2(20)
);

-- Create the label function

CREATE OR REPLACE FUNCTION label_function (
  schema_name IN VARCHAR2,
  object_name IN VARCHAR2
) RETURN VARCHAR2
IS
  label VARCHAR2(100);
BEGIN
  -- Retrieve the label based on the data's classification
  SELECT Classification INTO label FROM Documents WHERE rowid = SYS.DBMS_RLS.ROWID_EXPRESSION;
  RETURN label;
END;
/

-- Associate the label function with the table

BEGIN
  DBMS_RLS.ADD_POLICY(
    object_schema   => 'SCHEMA_NAME',
    object_name     => 'DOCUMENTS',
    policy_name     => 'DOCUMENTS_LABEL_POLICY',
    function_schema => 'SCHEMA_NAME',
    policy_function => 'LABEL_FUNCTION',
    statement_types => 'ALL',
    update_check    => FALSE,
    enable          => TRUE
  );
END;
/

-- Grant access to specific labels

BEGIN
  DBMS_MAC.ADD_AUTHORIZATION(
    grantee        => 'USER_NAME',
    policy_name    => 'DOCUMENTS_LABEL_POLICY',
    label          => 'Confidential',
    db_username    => 'SCHEMA_NAME',
    db_object_name => 'DOCUMENTS',
    auth_options   => DBMS_MAC.SHOW_USERS
  );
END;
/

-- Insert data with labels

INSERT INTO Documents (DocumentID, DocumentName, Classification) VALUES (1, 'Document1', 'Confidential');

INSERT INTO Documents (DocumentID, DocumentName, Classification)VALUES (2, 'Document2', 'Internal Use Only');

INSERT INTO Documents (DocumentID, DocumentName, Classification)VALUES (3, 'Document3', 'Public');

-- Query data based on label authorizations

SELECT DocumentID, DocumentName, Classification FROM Documents;