CREATE
OR
REPLACE
PACKAGE
SYS.dbms_fga
AS
?
-- ------------------------------------------------------------------------
?
-- CONSTANTS
?
--
? EXTENDED???
CONSTANT
PLS_INTEGER
:=
1
;
? DB?????????
CONSTANT
PLS_INTEGER
:=
2
;
? DB_EXTENDED
CONSTANT
PLS_INTEGER
:=
3
;????????????
-- (default)
? XML????????
CONSTANT
PLS_INTEGER
:=
4
;
? ALL_COLUMNS
CONSTANT
BINARY_INTEGER
:=
1
;
? ANY_COLUMNS
CONSTANT
BINARY_INTEGER
:=
0
;?????????
-- (default)
?
-- add_policy -? add a fine grained auditing policy to a table or view
?
--
?
-- INPUT PARAMETERS
?
--?? object_schema?? - schema owning the table/view, current user if NULL
?
--?? object_name???? - name of table or view
?
--?? policy_name???? - name of policy to be added
?
--?? audit_column??? - column to be audited
?
--?? audit_condition - predicates for this policy
?
--?? handler_schema? - schema where the event handler procedure is
?
--?? handler_module? - name of the event handler
?
--?? enable????????? - policy is enabled by DEFAULT
?
--?? statement_type? - statement type a policy applies to (default SELECT)
?
--?? audit_trail???? - Write sqltext and sqlbind into audit trail by default (DB_EXTENDED)
?
--?? audit_column_options - option of using 'Any' or 'All' on audit columns for the policy
?
PROCEDURE
add_policy(object_schema??
IN
VARCHAR2
:=
NULL
,
?????????????????????? object_name????
IN
VARCHAR2
,
?????????????????????? policy_name????
IN
VARCHAR2
,
?????????????????????? audit_condition
IN
VARCHAR2
:=
NULL
,
?????????????????????? audit_column???
IN
VARCHAR2
:=
NULL
,
?????????????????????? handler_schema?
IN
VARCHAR2
:=
NULL
,
?????????????????????? handler_module?
IN
VARCHAR2
:=
NULL
,
?????????????????????? enable?????????
IN
BOOLEAN
? :=
TRUE
,
???????????????
???????statement_types
IN
VARCHAR2
:=
'SELECT'
,
?????????????????????? audit_trail????
IN
PLS_INTEGER
? :=
3
,
?????????????????????? audit_column_opts
IN
BINARY_INTEGER
DEFAULT
0
);
?
-- drop_policy - drop a fine grained auditing policy from a table or view
?
--
?
-- INPUT PARAMETERS
?
--?? object_schema?? - schema owning the table/view, current user if NULL
?
--?? object_name???? - name of table or view
?
--?? policy_name???? - name of policy to be dropped
?
PROCEDURE
drop_policy(object_schema
IN
VARCHAR2
:=
NULL
,
??????????????????????? object_name??
IN
VARCHAR2
,
??????????????????????? policy_name??
IN
VARCHAR2
);
?
-- enable_policy - enable a security policy for a table or view
?
--
?
-- INPUT PARAMETERS
?
--?? object_schema?? - schema owning the table/view, current user if NULL
?
--?? object_name???? - name of table or view
?
--?? policy_name???? - name of policy to be enabled or disabled
?
PROCEDURE
enable_policy(object_schema
IN
VARCHAR2
:=
NULL
,
??????
???????????????????object_name??
IN
VARCHAR2
,
????????????????????????? policy_name??
IN
VARCHAR2
,
????????????????????????? enable???????
IN
BOOLEAN
:=
TRUE
);
?
-- disable_policy - disable a security policy for a table or view
?
--
?
-- INPUT PARAMETERS
?
--?? object_schema?? - schema owning the table/view, current user if NULL
?
--?? object_name???? - name of table or view
?
--?? policy_name???? - name of policy to be enabled or disabled
?
PROCEDURE
disable_policy(object_schema
IN
VARCHAR2
:=
NULL
,
?????????????????????????? object_name??
IN
VARCHAR2
,
?????????????????????????? policy_name??
IN
VARCHAR2
);
END dbms_fga;
??? 基本上每個部分的功能上面就已經說了,簡單得介紹一下需要注意的幾個地方:
?
??? 1、在審計策略生效之前,必須對表進行分析,因為只有在CBO模式,DBMS_FGA才能正確的工作
??? 2、指定audit_condition可以設定監控條件(例如select某部分記錄)
??? 3、可以指定audit_column來審計專門的字段
??? 4、statement_types包括“SELECT,UPDATE,INSERT.DELETE”四種,如需多種以','分開
?
?
舉例:
?
begin
dbms_fga.add_policy(object_schema => 'wangxiaoqi',? --schema名(默認當前操作用戶)
??????????????????? object_name => 't_check',?????? --被操作object對象
??????????????????? policy_name => 't_check_audit', --policy名(唯一)
??????????????????? audit_condition => NULL,
??????????????????? audit_column => 'tno,type,modifydate', --監視的字段(默認為全部)
??????????????????? handler_schema => NULL,
??????????????????? handler_module => NULL,
??????????????????? enable => TRUE,
??????????????????? statement_types => 'insert,update,delete', --受影響的操作?
??????????????????? audit_trail => dbms_fga.DB_EXTENDED,?????? --默認值
??????????????????? audit_column_opts => dbms_fga.ANY_COLUMNS);--默認值
end;
/
?
?
??? 當然也可以不用 => 來指定每個參數,只需要列出前幾個就可以了,有默認值的參數如果不需要改變默認值,可以不給出。 但是必須要按照定義的順序來指定。例如:
?
begin
dbms_fga.add_policy('wangxiaoqi','T1','T1_AUDIT','B>=20','B');
end;
/
?
?
?
?
?
??? select db_user,timestamp,sql_text,sql_bind from dba_fga_audit_trail; --審計結果
??? 注:如果指定了XML類型的審計,則在V$XML_AUDIT_TRAIL試圖中查看信息.