VPD column-masking: unexpected results using masked column in WHERE?

Question

Hi everyone..
We are considering implementing VPD column-masking (to hide sensitive columns from unauthorized users), but I am concerned that queries will return incorrect results if an unauthorized user submits a query using a masked column in a WHERE clause - particularly in a JOIN operation.
Our initial experiment confirms my concern:
- We have a VPD policy on TABLE_X.COLUMN_Y:
DBMS_RLS.ADD_POLICY(
object_schema => 'xxxx',
object_name => 'TABLE_X',
policy_name => 'policy_x',
function_schema => 'xxxx',
policy_function => 'function_x',
sec_relevant_cols =>'COLUMN_Y',
sec_relevant_cols_opt => dbms_rls.ALL_ROWS)
- The VPD function determines whether the user is authorized (1=1) or not (1=0)
- COLUMN_Y contains various values, including NULL
- when an "authorized" user submits the query "SELECT COUNT(*) FROM TABLE_X WHERE COLUMN_Y IS NULL", COUNT=correct number of rows containing NULL
- when an "unauthorized" user submits the same query, COUNT=the total number of rows in the table -- presumably because the WHERE clause was modified to WHERE NULL=NULL
In my opinion, the unauthorized user's query should return an error, because any other result is either wrong (i.e. COUNT=all rows, or returns a null result set) or something the user is not permitted to know (i.e. COUNT=correct number of rows)
Am I missing some feature/setting of VPD that could let me force an error? I hope there is something out there, since I don't see any discussion or warnings about this pitfall.
We are currently using Oracle 10.2.0.4 but upgrading to 11.1 soon.
Thanks!
Betty
p.s. I originally incorrectly posted this question on the Technologies / Security forum.

Answer 1

Thanks - yes, we have a function that checks whether the user id is authorized or not.
The column-masking works, that is, authorized users can see the data; unauthorized users cannot. The issue is what happens when unauthorized users use the masked column in a WHERE predicate.