You should understand how to use policy label columns.

• About the Policy Label Column
  Each policy that is applied to a table creates a column in the database.
• Hiding the Policy Label Column
  You can choose not to display the column representing a policy.

You can create label tags, either manually or automatically generating them, that define the label components.

• About Label Tags
  The administrator first defines a set of label components to be used in a policy.
• Manually Defined Label Tags to Order Labels
  By manually defining label tags, you can implement a data manipulation strategy that permits labels to be meaningfully sorted and compared.
• Manually Defined Label Tags to Manipulate Data
  An administratively defined label tag is a convenient way to reference a complete label string (that is, a combination of label components).
• Automatically Generated Label Tags
  Dynamically generated label tags have 10 digits, with no relationship to numbers assigned to any label component.

The CHAR_TO_LABEL function converts character strings to a label tag, returning the label tag for the specified character string.

• To convert a character string to a label tab, use the following syntax for the CHAR_TO_LABEL function:

  FUNCTION CHAR_TO_LABEL (
       policy_name     IN VARCHAR2,
       label_string    IN VARCHAR2)
  RETURN NUMBER; 

  For example:

  INSERT INTO emp (empno,hr_label) 
  VALUES (999, CHAR_TO_LABEL('HR','S:A,B:G5');

  Here, HR is the label policy name, S is a sensitivity level, A,B compartments, and G5 a group.

  FUNCTION CHAR_TO_LABEL (
       policy_name     IN VARCHAR2,
       label_string    IN VARCHAR2)
  RETURN NUMBER; 

You can convert label tags to character strings.

• Converting a Label Tag to a Character String with LABEL_TO_CHAR
  The LABEL_TO_CHAR function returns a VARCHAR2 string when it converts a label tag to a character string.
• LABEL_TO_CHAR Examples
  Oracle provides examples that illustrate the use of LABEL_TO_CHAR.
• Retrieving All Columns from a Table When the Policy Label Column Is Hidden
  If the policy label column is hidden, then it is not automatically returned when you execute SELECT * on the table.

There are different techniques of using numeric label tags in WHERE clauses of SELECT statements.

When using labels in the NUMBER format, you can set up labels so that a list of your label tags distinguishes the different levels. Comparisons of these numeric label tags can be used for ORDER BY processing, and with the logical operators.

For example, if you have assigned all UNCLASSIFIED labels to the 1000 range, all SENSITIVE labels to the 2000 range, and all HIGHLY_SENSITIVE labels to the 3000 range, then you can list all SENSITIVE records.

SELECT * FROM emp
WHERE hr_label BETWEEN 2000 AND 2999;

To list all SENSITIVE and UNCLASSIFIED records, you can enter:

SELECT * FROM emp
WHERE hr_label <3000;

To list all HIGHLY_SENSITIVE records, you can enter:

SELECT * FROM emp
WHERE hr_label=3000;

Alternatively, you can use dominance relationships to set up an ordering strategy.

The ORDER BY clause of a SELECT statement can be used to order rows by the numeric label tag.

• To perform the ORDER BY operation, use a SELECT statement similar to the following:

  SELECT * from emp
  ORDER BY hr_label;
  

  No functions were necessary in this statement. The statement made use of label tags set up by the administrator.

  Note:

  Again, such queries have meaning only if the administrator has applied a numeric ordering strategy to the label tags originally assigned to the labels.

The LABEL_TO_CHAR function orders data rows by the character representation of the label.

• To order data rows by the character representation of a label, use a statement similar to the following, which returns all rows sorted by the text order of the label:

  SELECT * FROM emp
  ORDER BY label_to_char (hr_label);

Oracle Label Security provides functions that determine the least upper bound or the greatest lower bound of two or more labels.

Two single-row functions operate on each row returned by a query. They return one result for each row.

• Finding Least Upper Bound with LEAST_UBOUND
  The OLS_LEAST_UBOUND (OLS_LUBD) function returns a character string label that is the least upper bound of label1 and label2:.
• Finding Greatest Lower Bound with GREATEST_LBOUND
  The OLS_GREATEST_LBOUND (OLS_GLBD) standalone function determines the lowest label of the data that can be involved in an operation, given two different labels.

The MERGE_LABEL function merges two labels together.

• To merge labels, use the following syntax:

  FUNCTION merge_label (label1 IN number,
                        label2 IN number,
                        merge_format IN VARCHAR2)
  RETURN number;

  The valid merge format is specified with a three-character string:

  highest_level_or_lowest_level union_or_intersection_of_compartments union_or_intersection_of_groups

  • The first character indicates whether to merge using the highest level or the lowest level of the two labels.

  • The second character indicates whether to merge using the union or the intersection of the compartments in the two labels.

  • The third character indicates whether to merge using the union or the intersection of the groups in the two labels.

  Table 6-5 defines the MERGE_LABEL format constants.

  Table 6-5 MERGE_LABEL Format Constants

  Format Specification	Data Type	Constant	Meaning	Positions in Which Format Is Used
  max_lvl_fmt	CONSTANT varchar2(1)	H	Maximum level	First (level)
  min_lvl_fmt	CONSTANT varchar2(1)	L	Minimum level	First (Level)
  union_fmt	CONSTANT varchar2(1)	U	Union of the two labels	Second (compartments) and Third (groups)
  inter_fmt	CONSTANT varchar2(1)	I	Intersection of the two labels	Second (compartments) and Third (groups)
  minus_fmt	CONSTANT varchar2(1)	M	Remove second label from first label	Second (compartments) and Third (groups)
  null_fmt	CONSTANT varchar2(1)	N	If specified in compartments column, returns no compartments. If specified in groups column, returns no groups.	Second (compartments) and Third (groups)

  For example, HUI specifies the highest level of the two labels, union of the compartments, intersection of the groups.

  The MERGE_LABEL function is particularly useful to developers if the LEAST_UBOUND function does not provide the intended result. The LEAST_UBOUND function, when used with two labels containing groups, may result in a less sensitive data label than expected. The MERGE_LABEL function enables you to compute an intersection on the groups, instead of the union of groups that is provided by the LEAST_UBOUND function.

  For example, if the label of one data record contains the group UNITED_STATES, and the label of another data record contains the group UNITED_KINGDOM, and the LEAST_UBOUND function is used to compute the least upper bound of these two labels, then the resulting label would be accessible to users authorized for either the UNITED_STATES or the UNITED_KINGDOM.

  If, by contrast, the MERGE_LABEL function is used with a format clause of HUI, then the resulting label would contain the highest level, the union of the compartments, and no groups. This is because UNITED_STATES and UNITED_KINGDOM do not intersect.

When you insert data into a table protected by an Oracle Label Security policy, you must supply a numeric label value tag.

Usually, you can insert this value in the INSERT statement itself.

To do this, you must explicitly specify the tag for the desired label or explicitly convert the character string representation of the label into the correct tag. Note that this does not mean generating new label tags, but referencing the correct tag. When Oracle Label Security is using Oracle Internet Directory, the only permissible labels (and corresponding tags) are those pre-defined by the administrator and already in Oracle Internet Directory.

The only times an INSERT statement may omit a label value are:

• If the LABEL_DEFAULT enforcement option was specified when the policy was applied, or

• If no enforcement options were specified when the policy was applied and LABEL_DEFAULT was specified when the policy was created

• If the statement applying the policy named a labeling function.

In the first two cases, the user's session default row label is used as the inserted row's label. In the third case, the inserted row's label is created by that labeling function.

To insert a row label, you can specify the label character string and then transform it into a label using the CHAR_TO_LABEL function.

• To insert labels, use an INSERT INTO statement.
  Using the definition for table emp, the following example shows how to insert data with explicit labels:

  INSERT INTO emp (ename,empno,hr_label)
  VALUES ('ESTANTON',10,char_to_label ('HR', 'SENSITIVE'));

You can insert data using the numeric label tag value of a label, rather than using the CHAR_TO_LABEL function.

• To insert labels using numeric label tag values, use an INSERT INTO statement.
  For example, if the numeric label tag for SENSITIVE is 3000, it would appear as follows:

  INSERT INTO emp (ename, empno, hr_label)
  VALUES ('ESTANTON', 10, 3000);

There are two situations in which you do not need to specify a label in INSERT statements.

• To insert data without specifying a label, use an INSERT INTO statement.
  For example:

  INSERT INTO emp (ename, empno)
  VALUES ('ESTANTON', 10);
  

  The resulting row label is set according to the default value (or by a labeling function).

If the label column is hidden, then the existence of the column is transparent to the insertion of data.

• To insert data when the policy label column is hidden, use the following syntax:

  INSERT INTO emp
  VALUES ('196','ESTANTON',Technician,RSTOUT,50000,10);
  

  Its label will be one of the following three possibilities:

  • The label you specify

  • The label established by the LABEL_DEFAULT option of the policy being applied

  • The label created by a labeling function named by the policy being applied

    Note:

    If the policy label column is not hidden, then you must explicitly include a label value (possibly null, indicated by a comma) in the INSERT statement.

The TO_DATA_LABEL function can generate new labels dynamically.

1. Ensure that you have the EXECUTE privilege on the TO_DATA_LABEL function.
2. Use the TO_DATA_LABEL as necessary, for example, in an INSERT INTO statement.
   For example:

   INSERT INTO emp (ename, empno, hr_label)
   VALUES ('ESTANTON', 10, to_data_label ('HR', 'SENSITIVE'));

   Note:

   The TO_DATA_LABEL function must be explicitly granted to individuals, in order to be used. Its usage should be tightly controlled.