【IT168 技术文档】

    增加 FGA 策略
   
    审计表

    GRANT RESOURCE,CONNECT TO BANK IDENTIFIED BY BANK;

    CREATE TABLE BANK.ACCOUNTS
    (
      ACCT_NO NUMBER PRIMARY KEY,
      CUST_ID NUMBER NOT NULL ,
      BALANCE NUMBER(15,2) NULL
    );
    insert into bank.accounts values(1,1,10000);
    insert into bank.accounts values(2,2,20000);
    commit;

    Begin
    dbms_fga.drop_policy (
      object_schema=>;'BANK',
      object_name=>;'ACCOUNTS',
      policy_name=>;'ACCOUNTS_ACCESS');
    dbms_fga.add_policy (
      object_schema=>;'BANK',
      object_name=>;'ACCOUNTS',
      policy_name=>;'ACCOUNTS_ACCESS');
    end;
    /

    select * from bank.accounts;
    select timestamp, db_user,os_user,object_schema,object_name,sql_text  from dba_fga_audit_trail;

    审计列和审计条件, 在add_policy中加入
      audit_column =>; 'BALANCE'
      audit_condition =>; 'BALANCE >;= 11000'
    Begin
    dbms_fga.drop_policy (
      object_schema=>;'BANK',
      object_name=>;'ACCOUNTS',
      policy_name=>;'ACCOUNTS_ACCESS');

    dbms_fga.add_policy (
      object_schema=>;'BANK',
      object_name=>;'ACCOUNTS',
      audit_column =>; 'BALANCE',
      audit_condition =>; 'BALANCE >;= 11000',
      policy_name=>;'ACCOUNTS_ACCESS');
    end;
    /

    这个不可用，Why?
    select BALANCE from bank.accounts;
    select timestamp, db_user,os_user,object_schema,object_name,sql_text  from dba_fga_audit_trail;

    
    
    管理 FGA 策略

    要删除策略，您可以使用以下语句： 

    begin
    dbms_fga.drop_policy (
    object_schema =>; 'BANK',
    object_name =>; 'ACCOUNTS',
    policy_name =>; 'ACCOUNTS_ACCESS'
       );
    end;
    /

    
    对于更改策略而言，没有随取随用的解决方案。要更改策略中的任何参数，必须删除策略，再使用更改后的参数添加策略。
    需要临时禁用审计收集 — 例如，如果您希望将线索表移动到不同的表空间或者要删除线索表。您可以按如下方法禁用 FGA 策略： 

    begin
    dbms_fga.enable_policy (
    object_schema =>; 'BANK',
    object_name =>; 'ACCOUNTS',
    policy_name =>; 'ACCOUNTS_ACCESS',
    enable =>; FALSE
       );
    end;
    /