6 Configuring Rule Sets

This chapter describes how to create and manage rule sets and the rules within them. It includes the following sections:

What Are Rule Sets?
Creating a Rule Set
Editing a Rule Set
Creating a Rule to Add to a Rule Set
Deleting a Rule Set
How Rule Sets Work
Example of How Rule Sets Work
Default Rule Sets
Guidelines for Designing Rule Sets
How Rule Sets Affect Performance
Related Reports

6.1 What Are Rule Sets?

A rule set is a collection of one or more rules that you can associate with a realm authorization, factor assignment, command rule, or secure application role. The rule set evaluates to true or false based on the evaluation of each rule it contains and the evaluation type (All True or Any True). A rule within a rule set is a PL/SQL expression that evaluates to true or false. You can create a rule and add the rule to multiple rule sets.

You can use rule sets to accomplish the following activities:

As a further restriction to realm authorization, to define the conditions under which realm authorization is active
To define when to allow a command rule
To enable a secure application role
To define when to assign the identity of a factor

When you create a rule set, Oracle Database Vault makes it available for selection when you configure the authorization for a realm, command rule, factor, or secure application role.

You can run reports on the rule sets that you create in Oracle Database Vault. See "Related Reports" for more information.

This chapter explains how to configure rule sets by using Oracle Database Vault Administrator. To configure rule sets by using the PL/SQL interfaces and packages provided by Oracle Database Vault, refer to the following appendixes:

6.2 Creating a Rule Set

In general, to create a rule set, you first create the rule set itself, and then you edit the rule set, create and immediately associate a new rule with the rule set, add existing rules to the rule set, or delete a rule association from the rule set. You also can create the rule set without any rules to use as a template for future rule sets.

6.3 Editing a Rule Set

To edit a rule set:

In the Oracle Database Vault Administration page, select Rule Sets.
In the Rule Set page, select the rule set that you want to edit.
Click Edit.
Modify the rule set as necessary, and then click OK.

6.4 Creating a Rule to Add to a Rule Set

After you create a new rule set, you can associate it with one or more rules. When you create a new rule, it is automatically added to the current rule set. You also can add existing rules to the rule set. Alternatively, you can omit adding rules to the rule set and use it as a template for rule sets you may want to create in the future.

The rule set evaluation depends on the evaluation of its rules using the Evaluation Options (All True or Any True). If a rule set is disabled, Oracle Database Vault evaluates the rule set to true without evaluating its rules.

6.4.1 Creating a New Rule

To create and add a rule to a rule set:

In the Oracle Database Vault Administration page, select Rule Sets.
In the Rule Sets page, select the rule set to which you want to create and add a rule, and then select Edit.
In the Edit Rule Set Page, scroll down to Rules Associated To The Rule Set and select Create.
In the Create Rule page, enter the following settings:
- Name: Enter a name for the rule. Use up to 90 characters in mixed-case.
- Rule Expression: Enter a PL/SQL expression that fits the following requirements:
  - It is valid in a SQL WHERE clause.
  - It can be a freestanding and valid PL/SQL Boolean expression such as the following:
```
TO_CHAR(SYSDATE,'HH24') = '12'
```
  - It must evaluate to a Boolean (TRUE or FALSE) value.
  - It must be no more than 255 characters long.
  - It can contain existing and compiled PL/SQL functions from the current database instance. Ensure that these are fully qualified functions (such as schema. function_name). Do not include complete SQL statements. For example:
```
SYS.CLIENT_IP_ADDRESS
```
    If you want to use application package functions or standalone functions, you must grant the DVSYS account the GRANT EXECUTE privilege on the function.
  See the following sections for functions that you can use in the rule set expression:
  See also the rule defined in the rule sets provided with Oracle Database Vault for example expressions. "Default Rule Sets" lists these rule sets.
Click OK.

The Edit Rule Set page appears. By default, the new rule is added to the rule set.

Editing a Rule

To edit a rule:

In the Edit Rule Set page, scroll to Rules Associated To The Rule Set.
Select the rule you want to edit and click Edit.
In the Edit Rule page, modify the rule as necessary.
Click OK.

Removing a Rule from a Rule Set

Before you remove a rule from a rule set, you can locate the various references to it by querying the rules-related Oracle Database Vault views. See "Oracle Database Vault Public Views" for more information.

To remove a rule from a rule set:

In the Edit Rule Set page, scroll to Rules Associated To The Rule Set.
Select the rule you want to delete and click Remove.
In the Confirmation page, click Yes.

After you remove the rule from the rule set, it still exists and is available to be associated with other rule sets. If you want to delete the rule, use the DVSYS.DBMS_MACADM.DELETE_RULE function, described in "Rule Set Functions Within DVSYS.DBMS_MACADM".

6.4.2 Adding Existing Rules to a Rule Set

To add existing rules to a rule set:

In the Rule Sets page, select the rule set that you want to add rules to, and then select Edit.
Under Rules Associated To The Rule Set, select Add Existing Rules.
In the Add Existing Rules page, select the rules you want, and then click Move (or Move All, if you want all of them) to move them to the Selected Rules list.

You can select multiple rules by holding down the Ctrl key as you click each rule.
Click OK.

6.5 Deleting a Rule Set

Before you delete a rule set, you can locate the various references to it by querying the rules-related Oracle Database Vault views. See "Oracle Database Vault Public Views" for more information.

To delete a rule set:

If other Database Vault objects, such as command rules, reference the rule set, then remove the reference.

You can delete a rule set only if no other Database Vault objects are referencing it.
In the Oracle Database Vault Administration page, select Rule Sets.
In the Rule Set page, select the rule set that you want to remove.
Click Remove.
In the Confirmation page, click Yes.

The rule set is deleted. However, the rules associated with the rule set are not deleted.

6.6 How Rule Sets Work

Oracle Database Vault evaluates the rules within a rule set as an unordered collection of expressions. If you have set Evaluation Options to All True and if a rule fails the evaluation, then the evaluation stops at that point, instead of attempting to evaluate the rest of the rules in the rule set. Similarly, if Evaluation Options is set to Any True and if a rule evaluates to true, the evaluation stops at that point. If a rule set is disabled, Oracle Database Vault evaluates it to true without evaluating its rules.

6.7 Example of How Rule Sets Work

In the following example, the Can Maintain Tables rule set has been created to control when table objects can be created, altered, or dropped. In Oracle Database Vault Administrator, Can Maintain Tables has the following settings:

Name: Can Maintain Tables
Description: Rules to control when data structures can be created, altered, or dropped
Status: Enabled
Evaluation Options: All True
Audit Options: Audit On Failure
Error Handling Options:
- Error Handling: Show Error Message
- Fail Code: -20465
- Fail Message: Invalid operation
- Custom Event Handler Option: Execute On Failure
- Custom Event Handler Logic: secmanager.raise_security_alert
Rules Associated To the Rule Set:
- Is Corporate Network: Its rule expression is
  
  DVF.F$NETWORK = 'Corporate'
- Is Maintenance Window: Its rule expression is
  
  TO_CHAR(SYSDATE,'HH24') BETWEEN '22' AND '23'

The secmanager.raise_security_alert event handler can raise a security alert to a set of pagers, or it can be used to integrate Oracle Database Vault with existing systems that provide security monitoring.

To complete the rule set, you can create one or more rules to associate with the rule set. For example:

Is Corporate Network: This rule limits table modifications only when the database session originates within the corporate network. It was created using a factor function. See "Oracle Database Vault PL/SQL Factor Functions" for more information. Chapter 4 explains how to create factors.
Is Maintenance Window: This rule restricts table modifications during the system maintenance window scheduled between 10:00 p.m. and 10:59 p.m.

You can use rule sets with realms, command rules, factors, and secure application roles. For example, to restrict a DROP TABLE statement on any table in the BIZAPP schema to execute only on the corporate network between 10:00 p.m. and 10:59 p.m., you could create a command rule that uses the Can Maintain Tables rule set. Figure 6-1 shows how to create this command rule.

Figure 6-1 Rule Set Used in Command Rule

Description of "Figure 6-1 Rule Set Used in Command Rule"

With this command rule in place, a database administrator can be prevented from intentionally or accidentally destroying data assets outside the security policy constraints.

Example 6-1 illustrates what happens when a database administrator attempts to destroy data outside the security policy constraints.

Example 6-1 Database Administrator Attempting to Destroy Data

SQL> CONNECT SYSTEM
Enter password: password
Connected.
SQL> DROP TABLE bizapp.accounts_payable;
ERROR at line 1:
ORA-01031: insufficient privileges

6.8 Default Rule Sets

By default, Oracle Database Vault provides the following selections for rule sets:

<Not Assigned>: Not a rule set, but is used to indicate that no rule set has yet been defined for the realm, factor, command rule, or secure application role. The realm authorization is still enabled.
Allow Sessions: Controls the ability to create a session in the database. This rule set enables you to add rules to control database logins using the CONNECT command rule. The CONNECT command rule is useful to control or limit SYSDBA access to programs that require its use. This rule set is not populated.
Can Grant VPD Administration: Controls the ability to grant the GRANT EXECUTE or REVOKE EXECUTE privileges on the Oracle Virtual Private Database DBMS_RLS package, with the GRANT and REVOKE statements.
Can Maintain Accounts/Profiles: Controls the roles that manage user accounts and profiles, through the CREATE USER, DROP USER, CREATE PROFILE, ALTER PROFILE, or DROP PROFILE statements.
Can Maintain Own Account: Allows the accounts with the DV_ACCTMGR role to manage user accounts and profiles with the ALTER USER statement. Also allows individual accounts to change their own password using the ALTER USER statement.
Check Trigger Init Parameter: Controls the ability to set system initialization parameters.
Disabled: Convenience rule set to quickly disable system features, for example, as part of testing or development, or in a production emergency.
Enabled: Convenience rule set to quickly enable system features.

6.9 Guidelines for Designing Rule Sets

Follow these guidelines for designing rule sets:

You can share rules among multiple rule sets. This lets you develop a library of reusable rule expressions. Oracle recommends that you design such rules to be discrete, single-purpose expressions.
Leverage Oracle Database Vault factors in your rule expressions to provide reusability and trust in the values used by your rule expressions. Factors can provide contextual information to use in your rules expressions.
You can use custom event handlers to extend Oracle Database Vault security policies to integrate external systems for error handling or alerting. Using Oracle utility packages such as UTL_TCP, UTL_HTTP, UTL_MAIL, UTL_SMTP, or DBMS_AQ can help you to achieve this type of integration.
Test rule sets thoroughly for various accounts and scenarios either on a test database or on a test realm or command rule for nonsensitive data before you apply them to realms and command rules that protect sensitive data. You can test rule expressions directly with the following SQL statement:
```
SQL> SELECT SYSDATE from DUAL where rule expression
```

6.10 How Rule Sets Affect Performance

In general, the more rules and more complex the rules, the worse the performance for execution of certain operations governed by these rule sets. For example, if you have a very large number of rules in a rule set governing a SELECT statement, rather than one rule in the rule set, performance could degrade significantly.

If you have rule sets that require many rules, performance improves if you move all the rules to logic defined in a single PL/SQL standalone or package function.

However, if a rule is used by other rule sets, there is little performance effect on your system.

You can check system performance by running tools such as Oracle Enterprise Manager (including Oracle Enterprise Manager Database Control, which is installed by default with Oracle Database), Statspack, and TKPROF. For more information about Oracle Enterprise Manager, see the Oracle Enterprise Manager documentation set. For information about Database Control, refer to its online Help. Oracle Database Performance Tuning Guide describes the Statspack and TKPROF utilities.

6.11 Related Reports

Table 6-1 lists Oracle Database Vault reports that are useful for analyzing rule sets and the rules within them. See Chapter 9, "Generating Oracle Database Vault Reports" for information about how to run these reports.

Table 6-1 Reports Related to Rule Sets

Report	Purpose
"Rule Set Configuration Issues Report"	To find rule sets that have no rules defined or enabled
"Secure Application Configuration Issues Report"	To find secure application roles that have incomplete or disabled rule sets
"Command Rule Configuration Issues Report"	To find rule sets that are incomplete or disabled