Function-based index error due to fine-grained security

Question

Hi, i'm working on Oracle version 9.2.0.5.
I'm trying to create a function-based index but i'm getting an error due to fine-grained security. I checked resource_view but if i'm not wrong I should have all necessary roles. I also added xdbadmin to this user to be sure.
I tried also to alter my session but it didn't worked.
Connected to Oracle9i Enterprise Edition Release 9.2.0.5.0
Connected as test_ste
SQL>
SQL> create index fbidx_schede_xml
  2  on schede_progetti_xml p
  3  (p.PROGETTO.extract('/Project/Elenco_unita/Unita/Responsabile/Cognome/text()').getStringVal());
create index fbidx_schede_xml
on schede_progetti_xml p
(p.PROGETTO.extract('/Project/Elenco_unita/Unita/Responsabile/Cognome/text()').getStringVal())
ORA-28133: full table access is restricted by fine-grained security
ORA-06512: at "SYS.XMLTYPE", line 0
ORA-06512: at line 1
SQL>
SQL> alter session set query_rewrite_enabled = true;
Session altered
SQL> alter session set query_rewrite_integrity = trusted;
Session altered
SQL> create index fbidx_schede_xml
  2  on schede_progetti_xml p
  3  (p.PROGETTO.extract('/Project/Elenco_unita/Unita/Responsabile/Cognome/text()').getStringVal());
create index fbidx_schede_xml
on schede_progetti_xml p
(p.PROGETTO.extract('/Project/Elenco_unita/Unita/Responsabile/Cognome/text()').getStringVal())
ORA-28133: full table access is restricted by fine-grained security
ORA-06512: at "SYS.XMLTYPE", line 0
ORA-06512: at line 1
SQL> select * from user_role_privs;
USERNAME                       GRANTED_ROLE                   ADMIN_OPTION DEFAULT_ROLE OS_GRANTED
TEST_STE                      CONNECT                        NO           YES          NO
TEST_STE                      CTXAPP                         NO           YES          NO
TEST_STE                      RESOURCE                       NO           YES          NO
TEST_STE                      XDBADMIN                       NO           YES          NO
SQL> This are ACL on my schema:
  <ACL>
    <acl description="Private:All privileges to OWNER only and not accessible to others" xmlns="http://xmlns.oracle.com/xdb/acl.xsd" xmlns:dav="DAV:"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/xdb/acl.xsd                           http://xmlns.oracle.com/xdb/acl.xsd">
      <ace>
        <principal>dav:owner</principal>
        <grant>true</grant>
        <privilege>
          <all/>
        </privilege>
      </ace>
    </acl>
  </ACL>I tried to create a similar function-based index on Oracle 10.2.0.3 without any problem and without touching any ACL, is an Oracle 9.2.0.5 problem?
Thanks for your attention.

Answer 1

I didn't really (production wise)work yet with VPD. I know a lot is based on DBMS_RLS and I guess (IF it is VPD related) it should be to hard to find in the doc's how you could check what is beyond your privileges. As a DBA I noticed that even the dba account SYSTEM isn't always allow to export the full content for the tables anymore.
There is a privilege that grants you all access that you need, despite the fact that you are not allowed to read certain rows from a table. Look it up.
In all, as I said, it looks like account is not allowed to see all data from a table. In that respect it sounds logical that you also are, in that case, not allowed to build a function based index on that data