0

Does Oracle offer a way to log instances where a given permission is evaluated?

Suppose I GRANT SELECT ANY DICTIONARY or something similar to a role, I am looking for a way to log every instance where the internal permissions engine of the database evaluates that exact permission for that role. Think of the audit.log on Linux systems that logs applications of SELinux policies.

I am also open to any workarounds achieving something similar.

1

Yes, that is entirely possible. The use of any privilege or grant can be audited by instance, by session, by success, or by failure. You can audit all uses, or just uses by specific users. See here for a basic guide to getting started: https://oracle-base.com/articles/8i/auditing, and here: https://oracle-base.com/articles/12c/auditing-enhancements-12cr1

For example:

CREATE AUDIT POLICY test_audit_policy
  PRIVILEGES CREATE TABLE, CREATE SEQUENCE
  WHEN    'SYS_CONTEXT(''USERENV'', ''SESSION_USER'') = ''TEST'''
  EVALUATE PER SESSION
  CONTAINER = CURRENT;

AUDIT POLICY test_audit_policy;

See here for a blog I wrote a few weeks ago about basic audits to use in 12c and up, called "Auditing By The Numbers"

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.