You may need to disable Oracle Label Security to perform upgrade tasks or correct erroneous configurations.

Another reason for disabling Oracle Label Security is if you want to test an application without enforcing Oracle Label Security. You can reenable Oracle Label Security after you complete the tasks.

If Oracle Database Vault has been enabled, then do not disable Oracle Label Security.

1. Log into the PDB as user SYS with the SYSDBA administrative privilege, or a user who has been granted the LBAC_DBA role.

   For example:

   sqlplus psmith_ols pdb_name
   Enter password: password
   

   To find the available PDBs, query the DBA_PDBS data dictionary view. To check the current PDB, run the show con_name command.

2. Query the DBA_DV_STATUS data dictionary view to find if Oracle Database Vault has been enabled in this PDB.
   Oracle Database Vault depends on Oracle Label Security. If Oracle Database Vault is installed in the PDB, then do not disable Oracle Label Security.

   SELECT * FROM DBA_DV_STATUS;

   Output similar to the following should appear:

   NAME                 STATUS
   -------------------- -----------
   DV_CONFIGURE_STATUS  FALSE
   DV_ENABLE_STATUS     FALSE

   If the output is FALSE, then you can disable Oracle Label Security.

3. Execute the following procedure:

   EXEC LBACSYS.OLS_ENFORCEMENT.DISABLE_OLS;
   

4. Connect to the CDB as a user with the SYSDBA administrative privilege.

   CONNECT / AS SYSDBA

5. Close and reopen the PDB.

   For example:

   ALTER PLUGGABLE DATABASE pdb_name CLOSE IMMEDIATE;
   ALTER PLUGGABLE DATABASE pdb_name OPEN;
   

6. For Oracle Real Application Clusters (Oracle RAC), repeat these steps for each Oracle RAC node on which you enabled Oracle Label Security.

You can enable Oracle Label Security in SQL*Plus.

1. Log into the PDB as user SYS with the SYSDBA administrative privilege, or a user who has been granted the LBAC_DBA role.

   For example:

   sqlplus psmith_ols pdb_name
   Enterp password: password
   

   To find the available PDBs, query the DBA_PDBS data dictionary view. To check the current PDB, run the show con_name command.

2. Execute the following procedure:

   EXEC LBACSYS.OLS_ENFORCEMENT.ENABLE_OLS;
   

3. Connect to the CDB as a user with the SYSDBA administrative privilege.

   CONNECT / AS SYSDBA

4. Close and reopen the PDB.

   For example:

   ALTER PLUGGABLE DATABASE pdb_name CLOSE IMMEDIATE;
   ALTER PLUGGABLE DATABASE pdb_name OPEN;
   

5. For Oracle Real Application Clusters (Oracle RAC), repeat these steps for each Oracle RAC node on which you enabled Oracle Label Security.

You can perform a full or partial uninstall of Oracle Label Security.

1. Log into the PDB as user SYS with the SYSDBA administrative privilege, or a user who has been granted the LBAC_DBA role.

   For example:

   sqlplus psmith_ols pdb_name
   Enter password: password
   

   To find the available PDBs, query the DBA_PDBS data dictionary view. To check the current PDB, run the show con_name command.

2. Ensure that Oracle Database Vault is not installed on this PDB by querying the DBA_USERS data dictionary view for the user DVSYS.

   SELECT USERNAME FROM DBA_USERS WHERE USERNAME = 'DVSYS';

   If the output shows DVSYS, then Oracle Database Vault is installed and you will need to uninstall Oracle Database Vault before you uninstall Oracle Label Security from the PDB.

3. Enter the following command to uninstall Oracle Label Security:

   @?/rdbms/admin/catnools.sql value [value]

   In this specification, value refers to one of the following settings:

   • FULL performs a complete uninstall of Oracle Label Security. No OLS columns or the label information within them is retained. You must have the LBAC_DBA role (or be user LBACSYS) to use this option. For example:

     @?/rdbms/admin/catnools.sql FULL

   • PARTIAL performs a partial uninstall by only dropping the Oracle Label Security policies. This option preserves the OLS label information but conditionally drops the OLS columns. You must have the LBAC_DBA role (or be user LBACSYS) to use this option. You can drop the policies with or without dropping the OLS columns by using one of following boolean flags:
     • TRUE drops the policies and the OLS label information columns in the tables for which the policy was applied. You must have the LBAC_DBA role (or be user LBACSYS) to use this option. For example:

       @?/rdbms/admin/catnools.sql PARTIAL TRUE

     • FALSE drop the policies but retains the OLS label information columns in the tables for which the policy was applied. You must have the LBAC_DBA role (or be user LBACSYS) to use this option. For example:

       @?/rdbms/admin/catnools.sql PARTIAL FALSE

   • LBACSYS uninstalls the LBACSYS schema only. You must be user SYS with the SYSDBA administrative privilege to use this option. For example:

     @?/rdbms/admin/catnools.sql LBACSYS

   • POLICIES uninstalls policies but retains the OLS label column. You must have the LBAC_DBA role (or be user LBACSYS) to use this option.

     @?/rdbms/admin/catnools.sql POLICIES

   • POLICIES_WITH_DATA uninstalls OLS policies without retaining the OLS label column. You must have the LBAC_DBA role (or be user LBACSYS) to use this option.

     @?/rdbms/admin/catnools.sql POLICIES_WITH_DATA

4. Connect to the CDB as a user with the SYSDBA administrative privilege.

   CONNECT / AS SYSDBA

5. Close and reopen the PDB.

   For example:

   ALTER PLUGGABLE DATABASE pdb_name CLOSE IMMEDIATE;
   ALTER PLUGGABLE DATABASE pdb_name OPEN;
   

6. For Oracle Real Application Clusters (Oracle RAC), repeat these steps for each Oracle RAC node on which you enabled Oracle Label Security.

You can reinstall Oracle Label Security in a PDB but not in the CDB root.

1. Log into the PDB as user SYS with the SYSDBA administrative privilege, or a user who has been granted the LBAC_DBA role.

   For example:

   sqlplus psmith_ols pdb_name
   Enter password: password
   

   To find the available PDBs, query the DBA_PDBS data dictionary view. To check the current PDB, run the show con_name command.

2. Query the DBA_OLS_STATUS data dictionary view to find if Oracle Label Security has already been installed and enabled in this PDB.
   For example:

   SELECT NAME, STATUS FROM DBA_OLS_STATUS;

   If the DBA_OLS_STATUS data dictionary view is not recognized, then Oracle Label security is not installed and you can reinstall it. If the output is as follows, showing FALSE, then you only need to register Oracle Label Security.

   NAME                 STATUS
   -------------------- -----------
   OLS_CONFIGURE_STATUS  FALSE
   OLS_DIRECTORY_STATUS  FALSE
   OLS_ENABLE_STATUS     FALSE

3. Exit SQL*Plus.
4. Enter the following command to reinstall Oracle Label Security:

   @?/rdbms/admin/catols.sql

5. Connect to the CDB as a user with the SYSDBA administrative privilege.

   CONNECT / AS SYSDBA

6. Close and reopen the PDB.

   For example:

   ALTER PLUGGABLE DATABASE pdb_name CLOSE IMMEDIATE;
   ALTER PLUGGABLE DATABASE pdb_name OPEN;
   

7. Register Oracle Label Security for the PDB.
8. For Oracle Real Application Clusters (Oracle RAC), repeat these steps for each Oracle RAC node on which you enabled Oracle Label Security.