• To convert a character string to a label tab, use the following syntax for the CHAR_TO_LABEL function:

  FUNCTION CHAR_TO_LABEL (
       policy_name     IN VARCHAR2,
       label_string    IN VARCHAR2)
  RETURN NUMBER; 
  
  

For example:

INSERT INTO emp (empno,hr_label) 
VALUES (999, CHAR_TO_LABEL('HR','S:A,B:G5');

Here, HR is the label policy name, S is a sensitivity level, A,B compartments, and G5 a group.

FUNCTION CHAR_TO_LABEL (
     policy_name     IN VARCHAR2,
     label_string    IN VARCHAR2)
RETURN NUMBER; 

Here, HR is the label policy name, S is a sensitivity level, A,B compartments, and G5 a group.

• To perform the ORDER BY operation, use a SELECT statement similar to the following:

  SELECT * from emp
  ORDER BY hr_label;
  

Notice that no functions were necessary in this statement. The statement made use of label tags set up by the administrator.

• To order data rows by the character representation of a label, use a statement similar to the following, which returns all rows sorted by the text order of the label :

  SELECT * FROM emp
  ORDER BY label_to_char (hr_label);

It accepts the character string form of two labels and the three-character specification of a merge format.

• To merge labels, use the following syntax:

  FUNCTION merge_label (label1 IN number,
                        label2 IN number,
                        merge_format IN VARCHAR2)
  RETURN number;
  

The valid merge format is specified with a three-character string:

<highest level or lowest level><union or intersection of compartments><union or intersection of groups>

• The first character indicates whether to merge using the highest level or the lowest level of the two labels.

• The second character indicates whether to merge using the union or the intersection of the compartments in the two labels.

• The third character indicates whether to merge using the union or the intersection of the groups in the two labels.

Table 6-5 defines the MERGE_LABEL format constants.

For example, HUI specifies the highest level of the two labels, union of the compartments, intersection of the groups.

The MERGE_LABEL function is particularly useful to developers if the LEAST_UBOUND function does not provide the intended result. The LEAST_UBOUND function, when used with two labels containing groups, may result in a less sensitive data label than expected. The MERGE_LABEL function enables you to compute an intersection on the groups, instead of the union of groups that is provided by the LEAST_UBOUND function.

For example, if the label of one data record contains the group UNITED_STATES, and the label of another data record contains the group UNITED_KINGDOM, and the LEAST_UBOUND function is used to compute the least upper bound of these two labels, then the resulting label would be accessible to users authorized for either the UNITED_STATES or the UNITED_KINGDOM.

If, by contrast, the MERGE_LABEL function is used with a format clause of HUI, then the resulting label would contain the highest level, the union of the compartments, and no groups. This is because UNITED_STATES and UNITED_KINGDOM do not intersect.

The CHAR_TO_LABEL function automatically creates a valid data label.

• To insert labels, use an INSERT INTO statement.

Using the definition for table emp, the following example shows how to insert data with explicit labels:

INSERT INTO emp (ename,empno,hr_label)
VALUES ('ESTANTON',10,char_to_label ('HR', 'SENSITIVE'));

• To insert labels using numeric label tag values, use an INSERT INTO statement.

For example, if the numeric label tag for SENSITIVE is 3000, it would appear as follows:

INSERT INTO emp (ename, empno, hr_label)
VALUES ('ESTANTON', 10, 3000);

If LABEL_DEFAULT is set, or if there is a labeling function applied to the table, then you do not need to specify a label in your INSERT statements. The label will be provided automatically.

• To insert data without specifying a label, use an INSERT INTO statement.

For example:

INSERT INTO emp (ename, empno)
VALUES ('ESTANTON', 10);

The resulting row label is set according to the default value (or by a labeling function).

INSERT statements can be written that do not explicitly list the table columns and do not include a value for the label column.

The session's row label is used to label the data, or a labeling function is used if one was specified when the policy was applied to the table or schema.

You can insert into a table without explicitly naming the columns, as long as you specify a value for each non-hidden column in the table. The following example shows how to insert a row into the table described in Example 2: Numeric Column Data Type with Hidden Column:

• To insert data when the policy label column is hidden, use the following syntax:

  INSERT INTO emp
  VALUES ('196','ESTANTON',Technician,RSTOUT,50000,10);
  

Its label will be one of the following three possibilities:

• The label you specify

• The label established by the LABEL_DEFAULT option of the policy being applied

• The label created by a labeling function named by the policy being applied

  Note:

  If the policy label column is not hidden, then you must explicitly include a label value (possibly null, indicated by a comma) in the INSERT statement.

This approach guarantees that the data labels are valid. However, be aware that when Oracle Label Security is installed to work with Oracle Internet Directory, dynamic label generation is not allowed, because labels are managed centrally in Oracle Internet Directory, using olsadmintool commands. Therefore, when Oracle Label Security is directory-enabled, this function, TO_DATA_LABEL, is not available and will generate an error message if used.

1. Ensure that you have the EXECUTE privilege on the TO_DATA_LABEL function.

2. Use the TO_DATA_LABEL as necessary, for example, in an INSERT INTO statement.

For example:

INSERT INTO emp (ename, empno, hr_label)
VALUES ('ESTANTON', 10, to_data_label ('HR', 'SENSITIVE'));