5 Configuring Rule Sets

This chapter describes how to create and manage rule sets and the rules within them. It includes the following sections:

What Are Rule Sets?
Default Rule Sets
Creating a Rule Set
Configuring or Editing a Rule Set
Creating a Rule to Add to a Rule Set
Deleting a Rule Set
How Rule Sets Work
Example of How Rule Sets Work
Guidelines for Designing Rule Sets
How Rule Sets Affect Performance
Related Reports

5.1 What Are Rule Sets?

A rule set is a collection of one or more rules that you can associate with a realm authorization, factor assignment, command rule, or secure application role. The rule set evaluates to true or false based on the evaluation of each rule it contains and the evaluation type (All True or Any True). A rule within a rule set is a PL/SQL expression that evaluates to true or false. You can create a rule and add the rule to multiple rule sets.

You can use rule sets to accomplish the following activities:

As a further restriction to realm authorization, to define the conditions under which realm authorization is active
To define when to allow a command rule
To enable a secure application role
To define when to assign the identity of a factor

When you create a rule set, Oracle Database Vault makes it available for selection when you configure the authorization for a realm, command rule, factor, or secure application role.

You can run reports on the rule sets that you create in Oracle Database Vault. See "Related Reports" for more information.

This chapter explains how to configure rule sets by using Oracle Database Vault Administrator. To configure rule sets by using the PL/SQL interfaces and packages provided by Oracle Database Vault, refer to the following appendixes:

5.2 Default Rule Sets

By default, Oracle Database Vault provides the following selections for rule sets:

Allow Sessions: Controls the ability to create a session in the database. This rule set enables you to add rules to control database logins using the CONNECT command rule. The CONNECT command rule is useful to control or limit SYSDBA access to programs that require its use. This rule set is not populated.
Allow System Parameters: Controls the ability to set system initialization parameters. See Oracle Database Reference for detailed information about initialization parameters.
Can Grant VPD Administration: Controls the ability to grant the GRANT EXECUTE or REVOKE EXECUTE privileges on the Oracle Virtual Private Database DBMS_RLS package, with the GRANT and REVOKE statements.
Can Maintain Accounts/Profiles: Controls the roles that manage user accounts and profiles, through the CREATE USER, DROP USER, CREATE PROFILE, ALTER PROFILE, or DROP PROFILE statements.
Can Maintain Own Account: Allows the accounts with the DV_ACCTMGR role to manage user accounts and profiles with the ALTER USER statement. Also allows individual accounts to change their own password using the ALTER USER statement.
Disabled: Convenience rule set to quickly disable security configurations like realms, command rules, factors, and secure application roles.
Enabled: Convenience rule set to quickly enable system features.

5.3 Creating a Rule Set

In general, to create a rule set, you first create the rule set itself, and then you edit the rule set to associate it with one or more rules. You can associate a new rule with the rule set, add existing rules to the rule set, or delete a rule association from the rule set. You also can create the rule set without any rules to use as a template for future rule sets.

5.4 Configuring or Editing a Rule Set

To configure or edit a rule set:

In the Oracle Database Vault Administration page, select Rule Sets.
In the Rule Set page, select the rule set that you want to edit.
Click Edit.
Modify the rule set as necessary, and then click OK.

5.5 Creating a Rule to Add to a Rule Set

After you create a new rule set, you can associate it with one or more rules. When you create a new rule, it is automatically added to the current rule set. You also can add existing rules to the rule set. Alternatively, you can omit adding rules to the rule set and use it as a template for rule sets you may want to create in the future.

The rule set evaluation depends on the evaluation of its rules using the Evaluation Options (All True or Any True). If a rule set is disabled, Oracle Database Vault evaluates the rule set to true without evaluating its rules.

See "How Rule Sets Work" for information on how rules are evaluated, how to nest rules, and how to create rules that exclude a particular user, such as a super system administrator.

5.5.1 Creating a New Rule

To create and add a rule to a rule set:

In the Oracle Database Vault Administration page, select Rule Sets.
In the Rule Sets page, select the rule set to which you want to create and add a rule, and then select Edit.
In the Edit Rule Set Page, scroll down to Rules Associated To The Rule Set and select Create.
In the Create Rule page, enter the following settings:
- Name: Enter a name for the rule. Use up to 90 characters in mixed-case.
- Rule Expression: Enter a PL/SQL expression that fits the following requirements:
  - It is valid in a SQL WHERE clause.
  - It can be a freestanding and valid PL/SQL Boolean expression such as the following:
```
TO_CHAR(SYSDATE,'HH24') = '12'
```
  - It must evaluate to a Boolean (TRUE or FALSE) value.
  - It must be no more than 255 characters long.
  - It can contain existing and compiled PL/SQL functions from the current database instance. Ensure that these are fully qualified functions (such as schema. function_name). Do not include complete SQL statements.
    
    If you want to use application package functions or standalone functions, you must grant the DVSYS account the GRANT EXECUTE privilege on the function. Doing so reduces the chances of errors when you add new rules.
  - Ensure that the rule works. You can test the syntax by running the following statement in SQL*Plus:
```
SELECT rule_expression from DUAL;
```
    For example, suppose you have created the following the rule expression:
```
SYS_CONTEXT('USERENV','SESSION_USER') != 'SQL*Plus'
```
    You would test this expression as follows:
```
SELECT SYS_CONTEXT('USERENV','SESSION_USER') FROM DUAL;
```
  See the following sections for functions that you can use in the rule set expression:
  For additional examples of expressions, see the rule defined in the rule sets provided with Oracle Database Vault. "Default Rule Sets" lists these rule sets.
Click OK.

The Edit Rule Set page appears. By default, the new rule is added to the rule set.

Editing a Rule

The changes you make to a rule apply to all rule sets that include the rule.

To edit a rule:

In the Edit Rule Set page, scroll to Rules Associated To The Rule Set.
Select the rule you want to edit and click Edit.
In the Edit Rule page, modify the rule as necessary.
Click OK.

Removing a Rule from a Rule Set

Before you remove a rule from a rule set, you can locate the various references to it by querying the rules-related Oracle Database Vault views. See "Oracle Database Vault Public Views" for more information.

To remove a rule from a rule set:

In the Edit Rule Set page, scroll to Rules Associated To The Rule Set.
Select the rule you want to delete and click Remove.
In the Confirmation page, click Yes.

After you remove the rule from the rule set, it still exists. If you want, you can associate it with other rule sets. If you want to delete the rule, use the DVSYS.DBMS_MACADM.DELETE_RULE function, described in "Rule Set Functions Within DVSYS.DBMS_MACADM".

5.5.2 Adding Existing Rules to a Rule Set

To add existing rules to a rule set:

In the Rule Sets page, select the rule set that you want to add rules to, and then select Edit.
Under Rules Associated To The Rule Set, select Add Existing Rules.
In the Add Existing Rules page, select the rules you want, and then click Move (or Move All, if you want all of them) to move them to the Selected Rules list.

You can select multiple rules by holding down the Ctrl key as you click each rule.
Click OK.

5.6 Deleting a Rule Set

Before you delete a rule set, you can locate the various references to it by querying the rules-related Oracle Database Vault views. See "Oracle Database Vault Public Views" for more information.

To delete a rule set:

If other Database Vault objects, such as command rules, reference the rule set, then remove the reference.

You can delete a rule set only if no other Database Vault objects are referencing it.
In the Oracle Database Vault Administration page, select Rule Sets.
In the Rule Set page, select the rule set that you want to remove.
Click Remove.
In the Confirmation page, click Yes.

The rule set is deleted. However, the rules associated with the rule set are not deleted.

5.7 How Rule Sets Work

This section describes how rule sets work in the following ways:

How Oracle Database Vault Evaluates Rules
Improving Performance by Setting the Order in Which Rules Appear in a Rule Set
Nesting Rules Within a Rule Set
Creating Rules to Apply to Everyone Except One User

5.7.1 How Oracle Database Vault Evaluates Rules

Oracle Database Vault evaluates the rules within a rule set as a collection of expressions. If you have set Evaluation Options to All True and if a rule fails the evaluation, then the evaluation stops at that point, instead of attempting to evaluate the rest of the rules in the rule set. Similarly, if Evaluation Options is set to Any True and if a rule evaluates to true, the evaluation stops at that point. If a rule set is disabled, Oracle Database Vault evaluates it to true without evaluating its rules.

5.7.2 Improving Performance by Setting the Order in Which Rules Appear in a Rule Set

Generally speaking, the order in which rules appear within a rule set does not affect the final outcome: the rule set either permits or prevents an action. However, the order can affect performance. You can place multiple rules within a single rule and prioritize them by using the AND or OR operator to improve the performance of the rule.

5.7.3 Nesting Rules Within a Rule Set

You can nest one or more rules within the rule set. For example, suppose you want to create a nested rule, Is Corporate Network During Maintenance, that performs the following two tasks:

It limits table modifications only when the database session originates within the corporate network.
It restricts table modifications during the system maintenance window scheduled between 10:00 p.m. and 10:59 p.m.

The rule definition would be as follows:

DVF.F$NETWORK = 'Corporate' AND TO_CHAR(SYSDATE,'HH24') BETWEEN '22' AND '23'

You can create it using a factor function. See "Oracle Database Vault PL/SQL Factor Functions" for more information. Chapter 7 explains how to create factors.

5.7.4 Creating Rules to Apply to Everyone Except One User

You can also create rules to apply to everyone except one user, for example, the super system administrator. The rule definition for this type of rule can be as follows:

SYS_CONTEXT('USERENV','SESSION_USER') = 'SUPERADMIN_USER' OR additional_rule

If the current user is the super system administrator, then the system evaluates the rule to true without evaluating additional_rule. If the current user is not the super system administrator, then the evaluation of the rule depends on the evaluation of additional_rule.

5.8 Example of How Rule Sets Work

In the following example, you will create a variation of the Can Maintain Tables rule set, which was created to control when table objects can be created, altered, or dropped. In your rule set, you will a PL/SQL procedure that sends an e-mail security alert if the rule is violated.

You will follow these steps to complete this example:

Step 1: Install and Configure the UTL_MAIL PL/SQL Package
Step 2: Create an E-mail Security Alert PL/SQL Procedure
Step 3: Create an Oracle Database Vault Rule Set That Uses the E-mail Security Alert
Step 4: Test the E-mail Security Alert

5.8.1 Step 1: Install and Configure the UTL_MAIL PL/SQL Package

Follow these steps:

Log on to SQL*Plus and install the UTL_MAIL package.
```
sqlplus "sys / as sysdba"
Enter password: password
SQL> @$ORACLE_HOME/rdbms/admin/utlmail.sql
SQL> @$ORACLE_HOME/rdbms/admin/prvtmail.plb
```
The UTL_MAIL package enables you to manage e-mail. See Oracle Database PL/SQL Packages and Types Reference for more information on UTL_MAIL.
Add the following configuration settings to the initialization configuration file, initsid.ora:
```
SMTP_SERVER="my_server.my_company.com"
SMTP_DOMAIN="my_company.com"
SMTP_SERVER_OUT="stmail.my_company.com"
```
Replace my_server and my_company.com with the name of your server and company. Enclose these settings in quotation marks.

5.8.2 Step 2: Create an E-mail Security Alert PL/SQL Procedure

Follow these steps:

Connect to SQL*Plus as the Oracle Database Owner (DV_OWNER) account. For example:
```
CONNECT dbvacctmgr
Enter password: password
```

Create the following procedure:

CREATE OR REPLACE PROCEDURE email_alert AS
msg varchar2(20000) := 'Realm violation occurred for the JSMITH rule set. The time is: ';
 
BEGIN
  msg := msg||to_char(SYSDATE, 'Day DD MON, YYYY HH24:MI:SS');
 
UTL_MAIL.SEND (
    sender      => 'youremail@yourcompany.com',
    recipients  => 'recipientemail@company.com',
    subject     => 'Tables are being modified during maintenance period!',
    message     => msg);
 
END email_alert;

Replace youremail@yourcompany.com with your e-mail address, and recipientemail@company with the e-mail address of the person you want to receive the notification.

Grant EXECUTE permissions on this procedure to DVSYS.
```
GRANT EXECUTE ON email_alert TO DVSYS; 
```

5.8.3 Step 3: Create an Oracle Database Vault Rule Set That Uses the E-mail Security Alert

Follow these steps:

As the DV_OWNER account, start Oracle Database Vault Administrator.

See "Starting Oracle Database Vault Administrator" for more information.
In Oracle Database Vault Administrator, create a rule that enforces the
In the Administration page, under Database Vault Feature Administration, click Rule Sets.
In the Rule Sets page, click Create.
Create the new rule set using the following settings:
- Name: Cannot Modify Tables During Maintenance Period
- Description: Rules to prevent tables from being created, altered, or dropped during the maintenance period
- Status: Enabled
- Evaluation Options: Any True
- Audit Options: Audit On Failure
- Error Handling Options:
  - Custom Event Handler Option: Execute On Failure
  - Custom Event Handler Logic: dbvacctmgr.email_alert
Click OK.
In Rule Sets page, select the Cannot Modify Tables During Maintenance Period rule set and then click Edit.
In the Edit Rule Set page, under Rules Associated To The Rule Set, click Create.
In the Create Rule page, enter the following settings:
- Name: Maintenance Window
- Rule Expression: Enter a setting to indicate a period of time for the maintenance window. A realistic time range would be the following:
  
  TO_CHAR(SYSDATE,'HH24') BETWEEN '22' AND '23'
  
  This time enforces the rule set at between 10 p.m. and 11 p.m. To test the rule set, you can enter a more convenient time, for example, between 10 a.m. and 10:59 a.m.:
  
  TO_CHAR(SYSDATE,'HH24') BETWEEN '10' AND '11'
Click OK.

5.8.4 Step 4: Test the E-mail Security Alert

Follow these steps:

Log on to SQL*Plus as a regular user.

For example:
```
sqlplus scott
Enter password: password
```
If the SCOTT account is locked and expired, you can unlock this account and create a new password as follows:
```
ALTER USER SCOTT ACCOUNT UNLOCK IDENTIFIED BY password;
```
Create a dummy table.
```
CREATE TABLE my_test
(col1 varchar2);
```
During the period when the Cannot Modify Tables During Maintenance Period rule set takes place, try running dropping the my_test:
```
DROP TABLE my_test;
ERROR at line 1:
ORA-01031: insufficient privileges
```
As you can see, SCOTT cannot drop this table, even though he owns it.

As a result, you should receive an e-mail with the following message:
```
Tables are being modified during maintenance period!
```
Outside the period when the Cannot Modify Tables During Maintenance Period rule set is in effect, for example, at 11:15 a.m., drop the my_test table:
```
DROP TABLE my_test;
Table dropped. 
```

You can use rule sets with realms, command rules, factors, and secure application roles. For example, to restrict a DROP TABLE statement on any table in the BIZAPP schema to execute only on the corporate network between 10:00 p.m. and 10:59 p.m., you could create a command rule that uses the Cannot Modify Tables During Maintenance Period rule set.

With this command rule in place, a database administrator can be prevented from intentionally or accidentally destroying data assets outside the security policy constraints.

Example 5-1 illustrates what happens when a database administrator attempts to destroy data outside the security policy constraints.

Example 5-1 Database Administrator Attempting to Destroy Data

SQL> CONNECT SYSTEM
Enter password: password
Connected.
SQL> DROP TABLE bizapp.accounts_payable;
ERROR at line 1:
ORA-01031: insufficient privileges

5.9 Guidelines for Designing Rule Sets

Follow these guidelines for designing rule sets:

You can share rules among multiple rule sets. This lets you develop a library of reusable rule expressions. Oracle recommends that you design such rules to be discrete, single-purpose expressions.
Leverage Oracle Database Vault factors in your rule expressions to provide reusability and trust in the values used by your rule expressions. Factors can provide contextual information to use in your rules expressions.
You can use custom event handlers to extend Oracle Database Vault security policies to integrate external systems for error handling or alerting. Using Oracle utility packages such as UTL_TCP, UTL_HTTP, UTL_MAIL, UTL_SMTP, or DBMS_AQ can help you to achieve this type of integration.
Test rule sets thoroughly for various accounts and scenarios either on a test database or on a test realm or command rule for nonsensitive data before you apply them to realms and command rules that protect sensitive data. You can test rule expressions directly with the following SQL statement:
```
SQL> SELECT SYSDATE from DUAL where rule expression
```
You can nest rule expressions inside a single rule. This helps to achieve more complex situations where you would need a logical AND for a subset of rules and a logical OR with the rest of the rules. See the definition for the Is Corporate Network During Maintenance rule set under "Example of How Rule Sets Work" for an example.

5.10 How Rule Sets Affect Performance

In general, the more rules and more complex the rules, the more performance overhead the performance for execution of certain operations governed by these rule sets. For example, if you have a very large number of rules in a rule set governing a SELECT statement, performance could degrade significantly.

If you have rule sets that require many rules, performance improves if you move all the rules to logic defined in a single PL/SQL standalone or package function.

However, if a rule is used by other rule sets, there is little performance effect on your system.

You can check system performance by running tools such as Oracle Enterprise Manager (including Oracle Enterprise Manager Database Control, which is installed by default with Oracle Database), Statspack, and TKPROF. For more information about Oracle Enterprise Manager, see the Oracle Enterprise Manager documentation set. For information about Database Control, refer to its online Help. Oracle Database Performance Tuning Guide describes the Statspack and TKPROF utilities.

5.11 Related Reports

Table 5-1 lists Oracle Database Vault reports that are useful for analyzing rule sets and the rules within them. See Chapter 11, "Oracle Database Vault Reports" for information about how to run these reports.

Table 5-1 Reports Related to Rule Sets

Report	Purpose
"Rule Set Configuration Issues Report"	To find rule sets that have no rules defined or enabled
"Secure Application Configuration Issues Report"	To find secure application roles that have incomplete or disabled rule sets
"Command Rule Configuration Issues Report"	To find rule sets that are incomplete or disabled