ACL in 11g

Question

Hello all,
I am trying to send email from PL/SQL as I have always done, using utl_smtp, however, on 11g I am now getting:
ERROR at line 1:
ORA-20100: OLD_ERR=ORA-24247: network access denied by access control list
(ACL)
The system is SusE:
Linux wtsuse 2.6.22.5-31-default #1 SMP 2007/09/21 22:29:00 UTC x86_64 x86_64 x86_64 GNU/Linux
I have tried following the instructions for the new ACL in Oracle 11:
as SYSTEM:
BEGIN
dbms_network_acl_admin.create_acl (acl => 'plj.xml',
description => 'Network permissions for abc.com',
principal => 'ABC',
is_grant => TRUE,
privilege => 'connect');
DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(acl => 'abc.xml',
principal => 'ABC',
is_grant => TRUE,
privilege => 'resolve');
DBMS_NETWORK_ACL_ADMIN.ASSIGN_ACL(acl => 'abc.xml',
host => 'mail.abc.net');
END;
commit;
But this does not help.
Same error when trying to send mail as ABC using UTL_SMTP.
Can send mail (using postfix) from the linux command line, no problem.
What do I need to do? It is not at all clear from the doc.
I notice that Oracle refers to a directory /sys/acls where an xml file is stored with the same name (abc.xml)
However, on SuSE this directory does not exist by default
Does Oracle create the XML file? and if so, where is the default location on SuSE - or should I create the directory? and if so as who (oracle?)
Any help will be greatly appreciated.
Paul

Answer 1

The Oracle 11g Upgrade manual describes it as follows (http://download.oracle.com/docs/cd/B28359_01/server.111/b28300/afterup.htm#BABFCBJI)
Configure Fine-Grained Access to External Network Services
Oracle Database 11g Release 1 (11.1) includes fine-grained access control to the UTL_TCP, UTL_SMTP, UTL_MAIL, UTL_HTTP, or UTL_INADDR
packages using Oracle XML DB. If you have applications that use one of these packages, you must install Oracle XML DB if it is not already
installed. You must also configure network access control lists (ACLs) in the database before these packages can work as they did in
prior releases.
The following example first looks for any ACL currently assigned to host_name. If one is found, then the example grants user_name the
CONNECT privilege in the ACL only if that user does not already have it. If no ACL exists for host_name, then the example creates a
new ACL called ACL_name, grants the CONNECT privilege to user_name, and assigns the ACL to host_name.
DECLARE
  acl_path  VARCHAR2(4000);
BEGIN
  SELECT acl INTO acl_path FROM dba_network_acls
   WHERE host = 'host_name' AND lower_port IS NULL AND upper_port IS NULL;
IF DBMS_NETWORK_ACL_ADMIN.CHECK_PRIVILEGE(acl_path,
                                         'user_name','connect') IS NULL THEN
    DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(acl_path,
                                         'user_name', TRUE, 'connect');
END IF;
EXCEPTION
  WHEN no_data_found THEN
    DBMS_NETWORK_ACL_ADMIN.CREATE_ACL('ACL_name.xml',
      'ACL description', 'user_name', TRUE, 'connect');
    DBMS_NETWORK_ACL_ADMIN.ASSIGN_ACL('ACL_name.xml','host_name');
END;
COMMIT;
Note:
The transaction must be committed for the changes to take effect.
Edited by: Marco Gralike on Oct 17, 2008 10:09 PM