Views - Security Loop Hole ?

Question

Dear Friends
To my understanding VIEWS can be used to provided elementary security to data. New Features like VPD (DBMS_RLS package) and Oracle Lable Security have been introduced in Oracle.
Can you please tell me what is limitation of using views from security point of view ? i.e I want a simple demonstration that reflects security loop hole due to VIEWS.
Thanks

Answer 1

Here's an elementary example of using a view for security:
CREATE TABLE person (
person_id  NUMBER(3),
first_name VARCHAR2(25),
last_name  VARCHAR2(25),
title_1    VARCHAR2(10),
title_2    VARCHAR2(10),
socsecno   VARCHAR2(11));
INSERT INTO person
VALUES (1, 'Dan', 'Morgan', 'BS', 'PhD', '123-54-0987');
INSERT INTO person
VALUES (1, 'Jack', 'Cline', 'BA', 'MA', '987-03-4793');
INSERT INTO person
VALUES (1,'Tara','Havemeyer','BA',NULL,'402-87-1005');
CREATE OR REPLACE VIEW person_security_view AS
SELECT first_name || ' ' || last_name NAME,
'***-**-' || SUBSTR(socsecno,8) SSN
FROM person;A loophole? How about putting it into the same schema with the table and granting SELECT on both.
Here's another example a bit more sophisticated:
exec dbms_application_info.set_client_info('747');
CREATE OR REPLACE FUNCTION app_info_wrapper RETURN VARCHAR2 IS
x VARCHAR2(64);
BEGIN
  dbms_application_info.read_client_info(x);
  RETURN x;
END app_info_wrapper;
CREATE OR REPLACE VIEW airplanes_view AS
SELECT *
FROM airplanes
WHERE program_id = app_info_wrapper;Source:
http://www.psoug.org/reference/dbms_applic_info.html
A loophole? Grant the end user the ability to alter the context for starters.