Initial commit

9781565924505

 No newline at end of file

## Example files for the title:  

# Oracle Security, by William Heney

[![Oracle Security, by William Heney](http://akamaicovers.oreilly.com/images/9781565924505/cat.gif)](https://www.safaribooksonline.com/library/view/title/1565924509//)

The following applies to example files from material published by O’Reilly Media, Inc. Content from other publishers may include different rules of usage. Please refer to any additional usage rights explained in the actual example files or refer to the publisher’s website.

O'Reilly books are here to help you get your job done. In general, you may use the code in O'Reilly books in your programs and documentation. You do not need to contact us for permission unless you're reproducing a significant portion of the code. For example, writing a program that uses several chunks of code from our books does not require permission. Answering a question by citing our books and quoting example code does not require permission. On the other hand, selling or distributing a CD-ROM of examples from O'Reilly books does require permission. Incorporating a significant amount of example code from our books into your product's documentation does require permission.

We appreciate, but do not require, attribution. An attribution usually includes the title, author, publisher, and ISBN.

If you think your use of code examples falls outside fair use or the permission given here, feel free to contact us at <permissions@oreilly.com>.

Please note that the examples are not production code and have not been carefully testing. They are provided "as-is" and come with no warranty of any kind.

doc

  mkaprole.sql

  Create the app_roles table.  This table will be used with the

tsec procedure to set password protected roles during the execution

of an application.

#

drop table app_roles;

create table app_roles

  (ROLE_NAME       VARCHAR2(30) NOT NULL , -- Name of role

   PROGRAM         VARCHAR2(48) NOT NULL ,

     -- TOOL Program associated with role.  Value found in v$session

   PASSWD          VARCHAR2(30) NOT NULL , -- Password for role

   APPLICATION     VARCHAR2(8) NOT NULL ,  -- Application name

     -- Application authorized to use role.  Argument 1 in function login.main.

   ROLE_DESC       VARCHAR2(80) -- Description

  )

tablespace &1

storage  (initial   50K

             next   24K

       maxextents  100

      pctincrease    0

         )

;

comment on table app_roles is

  'Security table for role passwords.  Read only by function tset.srole to extract the passwords.';

comment on column app_roles.role_name is

  'Name of role as it was created.';

comment on column app_roles.program is

  'TOOL program associated with the role.  Value comes from v$session';

comment on column app_roles.passwd is

  'Password for role.  Not encrypted.';

comment on column app_roles.application is

  'Name of application which should be running when role is enabled.';

comment on column app_roles.role_desc is

  'Comment or description of entry.';

doc  

     File:  mkpwsec.sql

     This script must be executed by the owner of the app_roles table.

     This script creates the tsec package and package body.

The body contains one function:  srole.  The function is used as

an argument to the standard database procedure dbms_session.set_role.

This procedure requires a string of roles to be set.  For example,

suppose a user had been granted the finadmin (financial administrator)

and finpersadmin (financial personnel administrator) roles, and that 

these roles were not set as defaults.  Then the command:

    dbms_session.set_role('finadmin','finpersadmin');

would activate the two roles.  If there were a password (blah) for

the finadmin role, then the command would be:

    dbms_session.set_role(finadmin identified by blah,finpersadmin);

    To avoid coding all the roles and passwords into applications,

the srole function will assemble the string of roles and passwords

for use by dbms_session.set_role.  Function srole is then used

as the argument to set_role thus:

      EXEC DBMS_SESSION.SET_ROLE(tsec.srole('APPLICATION_NAME'));

    Since the function is embedded in the call to set_role, it

will be executed first and will be executed within the database.  

The returned string becomes the argument list for set_role which

also executes within the database.  This means that the only argument

visable outside of the database when the call is made is the

application name required by function srole.  The returned string

of roles and passwords NEVER appears outside of the database,

nor is it ever seen by the application.

     The srole function returns a string to enable all roles granted

to the user appropriate for the application when the appropriate tool 

is running an appropriate application, as well as the user's default 

roles (including those granted to PUBLIC).

     Passwords for roles are maintained in APP_ROLES table, which has

the following structure:

 Name            Null?    Type

 --------------- -------- ----

 ROLE_NAME       NOT NULL VARCHAR2(30) -- Name of role

 PROGRAM         NOT NULL VARCHAR2(48)

     -- TOOL Program associated with role.  Value found in v$session

 PASSWD          NOT NULL VARCHAR2(30) -- Password for role

 APPLICATION     NOT NULL VARCHAR2(8)  -- Application name

     -- Application authorized to use role.  Argument 1 in function tsec.srole.

 ROLE_DESC                VARCHAR2(80) -- Description

Logic:

     The function checks V$SESSION to insure the the user is

running the correct TOOL for the role (like 'F45RUN.EXE').  If

the user is not running a registered tool and program, this function 

returns only the default roles.

     Calling format:

      EXEC DBMS_SESSION.SET_ROLE(tsec.srole('APPLICATION_NAME'));

     Returned value (assumes a standard role:  genselect):

     genselect, abc identified by xyz, def identified by uvw, ...

     Where:

          APPLICATION_NAME corresponds to the APPLICATION field

          in the table.  It is not case sensitive.

          abc and def are an example role names, and xyz and uvw

          are example role passwords.

     If the argument is "ALL", the all roles for the user will be

activated.

     When creating users, grant all roles to the user, then alter

the user to make the role with "create session" the default role. 

For example a standard select only role would be GENSELECT.

#

create or replace package tsec is

  function srole (arg1 in varchar2) return varchar2;

end;

/

create or replace package body tsec as

function srole (arg1 in varchar2) return varchar2 is

  role_cmd varchar2(256);

  prog_name varchar2(48);

  i integer;

-- Get the password protected roles then get the user's default role.

  cursor c1 is

    select role_name ||

      decode(a.passwd, null, null, ' IDENTIFIED BY '||a.passwd) result

      from app_roles a, dba_role_privs r,

           v$session v, dba_roles dr

     where upper(a.application) = upper(arg1)

       and a.role_name = r.granted_role

       and a.role_name = dr.role

       and r.grantee = user

       and dr.password_required = 'YES'

       and instr(v.program, a.program) > 0

--       and upper(a.program) = upper(v.program)

       and (instr(upper(nvl(v.module,'NO MODULE')),'SQL') = 0

            or

            upper(a.program) = 'ALL')

       and v.audsid = userenv('SESSIONID')

    union

    select drp.granted_role

      from dba_role_privs drp, dba_roles dr

     where drp.granted_role = dr.role

       and dr.password_required = 'NO'

       and drp.default_role = 'YES'

       and grantee in (user, 'PUBLIC')

    ;

role_rec c1%ROWTYPE;

begin

-- Get the program the user is executing from v$session.

-- The USERENV function returns a unique audit session id for

-- each session.  A session represents a database connection.

-- For example, an VisualBasic application session and a Q+E

-- session would return different rows.

/*

select 

  substr(program, instr(program,'\',-1) + 1) into prog_name

      from v$session where audsid = userenv('SESSIONID');

*/

-- Following query will return no rows if the program in

-- v$session does not match the program in app_roles table

  i := 0;

  open c1;

  LOOP

     FETCH c1 into role_rec;

     EXIT WHEN c1%NOTFOUND;

     i := i+1;

     IF (i = 1) THEN

        role_cmd := role_rec.result;

     ELSE

        role_cmd := role_cmd || ', ' || role_rec.result;

     END IF;

  END LOOP;

  CLOSE c1;

  RETURN role_cmd;

end;

end tsec;

/

doc

   mksysadm.sql

   This script must be executed by user sys.

   Arguments:  1 =  username for sysadm user (password is the same)

               2 =  default tablespace for sysadm user

               3 =  temporary tablespace for sysadm user

               4 =  owner of app_roles table

               5 =  password for owner

   Create the privileges necessary for a system administrator

   role.  Create a system administration user.  This user must

   be able to create and drop users and roles and also update

   the app_roles table.  Access to certain system tables is also

   required.  Privileges required are checked in the user role

   maintenance form and it will not start if the seven privileges

   specified here are not granted.

#

set termout on echo on

spool mksysadm.lis

-- Attempt to drop the role.  Error here is ok.

drop role admin_usr_role;

-- Create the sysadmin role

create role admin_usr_role;

-- Privilege to connect and establish a login session

grant create session to admin_usr_role;

-- Privileges for personal objects

grant create synonym to admin_usr_role;

grant create procedure to admin_usr_role;

-- Privileges to administer users

grant create user to admin_usr_role;

grant drop user to admin_usr_role;

grant alter user to admin_usr_role;

-- Privileges to administer roles

grant create role to admin_usr_role;

grant drop any role to admin_usr_role;

grant alter any role to admin_usr_role;

grant grant any role to admin_usr_role;

-- Privilege to grant privileges to roles or users

grant grant any privilege to admin_usr_role;

-- Create the system administration user, grant the role,

-- set default and temporary tablespaces.

create user &1 identified by &1;

grant admin_usr_role to &1;

alter user &1

  default tablespace &2

  temporary tablespace &3

  default role admin_usr_role

  ;

-- Grant privileges on sys's views to the system administrator

-- not the role.  This user will be executing PL/SQL and that

-- engine does not recognize privileges granted through roles.

grant select on &tab to &1 with grant option

define tab=sys.dba_roles

/

define tab=sys.dba_role_privs

/

define tab=sys.dba_users

/

define tab=sys.dba_sys_privs

/

define tab=sys.dba_tablespaces

/

define tab=sys.system_privilege_map

/

define tab=v_$session

/

-- Create synonyms for the security user

create synonym &1..dba_roles for sys.dba_roles;

create synonym &1..dba_role_privs for sys.dba_role_privs;

create synonym &1..dba_users for sys.dba_users;

create synonym &1..dba_sys_privs for sys.dba_sys_privs;

create synonym &1..dba_tablespaces for sys.dba_tablespaces;

create synonym &1..system_privilege_map for sys.system_privilege_map;

create synonym &1..v$session for sys.v_$session;

-- Connect as the app_roles table owner and grant privs to security

connect &4/&5

grant select, insert, update, delete on app_roles to &1

  with grant option;

-- Connect as the sysadm user and create a private synonym

-- for the role security table and the sys tables.  Cannot

-- guarantee that public synonyms exist.

connect &1/&1

create synonym app_roles for &4..app_roles;

spool off

set echo off

prompt

prompt SPOOL FILE FOR MKSYSADM IS:  mksysadm.lis

prompt