Oracle Label Security

Protect PII by controlling Secure Application Roles with
OLS User Authorizations

---

Create Label Security policy	Define label components	Authorize users	Create procedure to enable role

The Secure Application Role procedure will do the following:

1. Get the numerical label_tag from the user's current label
2. Get the numerical label_tag from the 'SENS:PII' label
3. User label ≥ 'SENS:PII' label → role will be set for user
4. User label < 'SENS:PII' label → role will not be set for user

SQL> grant pii_role to <user>;
SQL> alter user <user> set default role none;

CREATE OR REPLACE PROCEDURE p_pii_roles authid current_user
 IS    
    session_tag	number;		-- numerical expression of session label
    sens_tag	number;		-- numerical expression of SENS:PII label
  
  BEGIN
  session_tag := sa_util.numeric_label('PROTECT_PII');
                                -- numerical expression of session label

  sens_tag := char_to_label('PROTECT_PII','SENS:PII');
                                -- numerical expression of the SENS:PII label

  if 	dominates (session_tag, sens_tag) = 1 then
                                -- true (1) if session label ≥ SENS:PII label
        dbms_session.set_role('pii_role');
  
  else  null;                   -- else do nothing
  end if;
END p_pii_roles;
/