VPD Question

Question

Hi all,
I have a technical question about VPD.
The documentation says, VPD is working the following way:
When a user issues a statement, the statement is automaticly rewritten. This is done by appending a predicate delivered by a pl/sql function to the original query just before the parsing of the query is done.
But it was not working as I expected. I can give you an example:
I have to schemas. One schema (lets say scott) contains my application data. The other schema (say vpd_admin) stores the policies.
In the vpd_admin schema I created a procedure to return the predicate:
CREATE OR REPLACE FUNCTION nur_bereich (
                               p_schema IN VARCHAR2 DEFAULT NULL,
                               p_object IN VARCHAR2 DEFAULT NULL)
                       RETURN VARCHAR2
AS
BEGIN
  IF sys_context('my_ctx','user') is null then
    RETURN NULL;
  ELSE
      IF p_object = 'EMP' THEN
        RETURN 'ename = sys_context(''my_ctx'',''user'') ' ;
      ELSIF p_object = 'DEPT' THEN
        RETURN 'deptno IN (SELECT deptno FROM emp)';
      END IF;
    END IF;
  END IF;
END;
/I applied the the policy to both tables (emp and dept)
BEGIN
DBMS_RLS.add_policy
         (object_schema => 'SCOTT',
          object_name => 'EMP',
          policy_name => 'ONLY_ME',
          function_schema => 'vpd_admin',
          policy_function => 'nur_bereich',
          statement_types => 'SELECT,INSERT,UPDATE',
          update_check => TRUE,
          policy_type => dbms_rls.CONTEXT_SENSITIVE
END;
BEGIN
DBMS_RLS.add_policy
         (object_schema => 'SCOTT',
          object_name => 'DEPT',
          policy_name => 'ONLY_ME',
          function_schema => 'vpd_admin',
          policy_function => 'nur_bereich',
          statement_types => 'SELECT,INSERT,UPDATE',
          update_check => TRUE,
          policy_type => dbms_rls.CONTEXT_SENSITIVE
END;
/But if I issue a select statement against the dept table, I get an Invalid predicate exception. After looking at the generated trace file, I found that the original error is a table not found exception. After granting select on emp to vpd_admin and creating a synonym it works like a charm.
It appears to me, that the parsing is done in the vpd_admin schema. But the next strange thing was, that when i created the policy function in the scott schema and applied this policy to the dept table (using the vpd_admin schema), it works great.
So now I a disturbed about the question how the query rewrite is done, where is it done and who does the parsing.
Any explanation would be welcome.
Regards
Stephan

Answer 1

Hi Rob,
thank you for your answer. But what I don't understand is why the secure schema must be able to access the table to which the policy is linked. I thought the policy function returns the predicate and then the query is rewritten with the privileges of the user issuing the query. But it appears that the query is rewritten with the privileges of the user that owns the predicate function. So if the predicate function is defined in the scott schema, the query is rewritten and parsed in the scott schema. And if the predicate function is defined in the secure schema, the query is rewritten and parsed in the secure schema.
So my initial guess, that the query is rewritten in the secure schema and is afterwards parsed as SCOTT is wrong. Or does the process of rewriting the query need access to SCOTT objects referenced by the the predicate? I think thats very likely.
If I got it right, the process of how VPD works is:
1; User queries table emp
2; VPD intercepts the query and evaluated the policy function defined in a secure schema
3; The query is rewritten in the secure schema. This process may need access to the tables and or objects of the query schema
4; After the query is rewritten in the secure schema, it is parsed and executed in the query schema. The user gets his data.
Is this correct?
Thanks
Stephan