Using VPD/FGA to null specific columns for all but some users

Question

I've been reading up on VPD and - though there a numerous examples - I'm having a tough time putting them together.
I have a table that - when most users select against - they should be getting NULL back in a specific column.
That column should only display for a select group of users as a value of other than null.
Can anyone help me out with an example of implementing this?
Any/all help is appreciated.

Answer 1

An extract from http://www.oracle-base.com/articles/10g/DatabaseSecurityEnhancements10g.php
CONN sys/password@db10g AS SYSDBA
GRANT EXECUTE ON dbms_rls TO scott;
CONN scott/tiger@db10g
-- Create the policy function to restrict access to SAL and COMM columns
-- if the employee is not part of the department 20.
CREATE OR REPLACE FUNCTION pf_job (oowner IN VARCHAR2, ojname IN VARCHAR2)
RETURN VARCHAR2 AS
  con VARCHAR2 (200);
BEGIN
  con := 'deptno = 20';
  RETURN (con);
END pf_job;
-- Using the same policy function as before.
BEGIN
  DBMS_RLS.ADD_POLICY (object_schema         => 'scott',
                       object_name           => 'emp',
                       policy_name           => 'sp_job',
                       function_schema       => 'scott',
                       policy_function       => 'pf_job',
                       sec_relevant_cols     => 'sal,comm',
                       sec_relevant_cols_opt => DBMS_RLS.ALL_ROWS);
END;
-- All rows are returned but the SAL and COMM values are only
-- shown for employees in department 20.
SELECT empno, ename, job, sal, comm FROM emp;
     EMPNO ENAME      JOB              SAL       COMM
      7369 SMITH      CLERK          10000
      7499 ALLEN      SALESMAN
      7521 WARD       SALESMAN
      7566 JONES      MANAGER         2975
      7654 MARTIN     SALESMAN
      7698 BLAKE      MANAGER
      7782 CLARK      MANAGER
      7788 SCOTT      ANALYST         3000
      7839 KING       PRESIDENT
      7844 TURNER     SALESMAN
      7876 ADAMS      CLERK           1100
     EMPNO ENAME      JOB              SAL       COMM
      7900 JAMES      CLERK
      7902 FORD       ANALYST         3000
      7934 MILLER     CLERK
14 rows selected.
-- Remove the policy function from the table.
BEGIN
  DBMS_RLS.DROP_POLICY (object_schema     => 'scott',
                        object_name       => 'emp',
                        policy_name       => 'sp_job');
END;
/The function returns "deptno=20" so any row matching this condition will display the sal and comm value , rest will display null.
IN your case I guess you check for the user in the function who is executing the query (select user from dual), once you get the user see if this is a user who is suppose to see the columns values if yes return "1=1" otherwise return "0=1".