How to avoid a table to be selected by a user with 'select any table' grant

Question

Hello,
I want a table to be non selectable for a particular user even if that user has a 'select any table' grant.
either the query can return no rows or an error message, it doesn't matter.
how can I achieve this with a standard database configuration? I mean I am not allowed to use any tool of Oracle like vault etc..
thanks in advance...

Answer 1

Fine-grained access control (aka VPD, more or less) is part of Enterprise Edition. It is not a separate tool. See Oracle Database Editions
You can read about it here Using Oracle Virtual Private Database to Control Data Access
The main thing to understand is the predicte-generating function, and all the opportunities there. This example is from a presentation I once gave to a local Oracle users group.
The policy (not shown) specifies FGAC_PKG.FGAC_PREDICATE_FNC as the predicate-generating function. If the user has role FGAC_DEMO_ALL_COMPANIES_ROLE then his view is not restricted; if his username does not appear in the COMPANY_AUTHORIZATION table he will get an error when querying the protected table; otherwise he will be restricted to see only the companies he is authorized for. So this has some elements that may be useful to you.
CREATE OR REPLACE PACKAGE BODY FGAC_DEMO_SCHEMA.FGAC_PKG AS
FUNCTION  FORCE_FGAC_ERROR_FNC (in_object VARCHAR2) RETURN NUMBER IS
    e_not_authorized exception;
    PRAGMA exception_init(e_not_authorized, -20667);
BEGIN
    RAISE e_not_authorized;
    RETURN (-1);  -- will NEVER get here (have already raised an error)
EXCEPTION
   WHEN e_not_authorized  then
     RAISE_APPLICATION_ERROR (sqlcode,
                              sqlerrm||'Access to '|| in_object ||
                              ' requires access to at least one company, but none have been authorized.' );
END FORCE_FGAC_ERROR_FNC;
FUNCTION FGAC_PREDICATE_FNC (in_schema VARCHAR2, in_object VARCHAR2)
   RETURN VARCHAR2
IS
   out_predicate   VARCHAR2 (400);
   c_filter_predicate constant varchar2(400) :=
      'COMPANY_ID IN (SELECT COMPANY_ID FROM COMPANY_AUTHORIZATION '||
      'WHERE USER_NAME = USER)';
   c_bypass_filtering_role VARCHAR2(30) := 'FGAC_DEMO_ALL_COMPANIES_ROLE';
   v_authorization_count NUMBER;
   c_error_predicate constant varchar2(400) :=
      'FGAC_DEMO_SCHEMA.FGAC_PKG.FORCE_FGAC_ERROR_FNC('''||
           in_schema||'.'||in_object||''') = 0';
BEGIN
  IF DBMS_SESSION.is_role_enabled (c_bypass_filtering_role) THEN
      out_predicate :=  NULL;
  ELSE
     SELECT COUNT(*) INTO v_authorization_count
        FROM COMPANY_AUTHORIZATION
        WHERE USER_NAME = USER;
     IF  v_authorization_count = 0 then
       out_predicate :=  c_error_predicate;
     ELSE
      out_predicate :=  c_filter_predicate;
    END IF;
  END IF;
  RETURN out_predicate;
END FGAC_PREDICATE_FNC;
END FGAC_PKG;