OLS AND VPD Column Masking.

Question

I have gone over a couple of sources on OLS and VPD.
BTW I am working with Oracle 11g R1.
What I am trying to accomplish is cell level protection. Where cell is defined as the intersection between a row and a column.
OLS will get me the proper row restrictions.
VPD has the ability to do Column Masking.
Has anyone mix the two to accomplish cell level protection?
Basic examples would be GREATLY appreciated.

Answer 1

Hi again. Thank you for your reply, but I wanted to achieve cell-level security as I'm trying to create conception of fine-grained processing data with different levels of confidentiality. Here is what I have:
- I created 3 levels of confidentiality: J < P < T (Unclassified < Confidential < Secret)
- I created a table and here is how it looks for different users:
User with T-level authorization:
!http://img709.imageshack.us/img709/1847/screentj.png!
User with P-level authorization (can't see T-level data):
!http://img704.imageshack.us/img704/4002/screenp.png!
I did that by creating two policies on two columns with data:
CREATE OR REPLACE FUNCTION f_data01 (schema in varchar2, tab in varchar2) -- or "CREATE OR REPLACE FUNCTION f_data02" for second column
  RETURN varchar2 AS
    predicate         varchar2(2000);        -- the VPD 'where' clause
    session_lab        varchar2(4000);        -- the current user's session label
    session_tag        number;            -- numerical expression of session label
    t_sa_user_name    varchar2(2000);        -- only users with Labels are examined, others don't get access.
BEGIN
  session_lab := sa_session.label('cells');        -- the current user's session label for that policy
  session_tag := char_to_label('cells',session_lab);    -- numerical expression of session label
  predicate := 'dominates(' || session_tag || ',CDATA01)=1'; -- or "predicate := 'dominates(' || session_tag || ',CDATA02)=1';" for second column
  return predicate;
END;I asked if it is possible to create one policy with variable instead of column name (ex. CDATA01) or if there is another way to get that effect.
And is it good practice to put column with labels in one table with data?
Thank you in advance.
Edited by: arc.undcvr on 2010-01-23 22:50