Thank you for providing the code again – I was a little confused by the code (in your previous reply) that remained after WordPress deleted the code between the less than and greater than signs. This feature has damaged my comments a couple of times also. “& l t ;” without spaces will be understood as a less than sign, while “& g t ;” without spaces will be understood as greater than.

That code is impressive. If someone were to create the trigger with the rest of your code, every new table will automatically adopt the security policy – that is something that certainly could be forgotten.

Here is a demonstration of the fine-grain access control code in action:

SQL> create table t4 as select rownum rn from dual connect by level<=1000;
 
Table created.

SQL> select * from t4;

        RN
----------
         1
         2
         3
...
        97
        98
        99
        RN
----------
       100
 
100 rows selected.

A bonus side-effect is that the optimizer mode might change to FIRST_ROWS_100 when the SQL statement is excuted by a normal user, but remain unaffected when run by SYS. The optimizer mode did not change on 11.2.0.1, but that does not mean the same results will be achieved in older release versions.

SQL> SELECT * FROM TABLE(DBMS_XPLAN.DISPLAY_CURSOR(NULL,NULL,'TYPICAL'));
 
SQL_ID  dvrswdm4s3tuu, child number 0
-------------------------------------
select * from t4
 
Plan hash value: 1934969519
 
----------------------------------------------------------------------------
| Id  | Operation           | Name | Rows  | Bytes | Cost (%CPU)| Time     |
----------------------------------------------------------------------------
|   0 | SELECT STATEMENT    |      |       |       |     2 (100)|          |
|   1 |  VIEW               | T4   |   100 |  1300 |     2   (0)| 00:00:01 |
|*  2 |   COUNT STOPKEY     |      |       |       |            |          |
|   3 |    TABLE ACCESS FULL| T4   |  1000 | 13000 |     2   (0)| 00:00:01 |
----------------------------------------------------------------------------
 
Predicate Information (identified by operation id):
---------------------------------------------------
   2 - filter(ROWNUM<101)
 
Note
-----
   - dynamic sampling used for this statement (level=2)

SQL> SELECT NAME,VALUE FROM V$SQL_OPTIMIZER_ENV WHERE SQL_ID='dvrswdm4s3tuu' ORDER BY NAME;
 
NAME                                     VALUE
---------------------------------------- -------------------------
_pga_max_size                            409600 KB
active_instance_count                    1
bitmap_merge_area_size                   1048576
cell_offload_compaction                  ADAPTIVE
cell_offload_plan_display                AUTO
cell_offload_processing                  true
cpu_count                                8
cursor_sharing                           exact
db_file_multiblock_read_count            128
dst_upgrade_insert_conv                  true
hash_area_size                           131072
is_recur_flags                           0
optimizer_capture_sql_plan_baselines     false
optimizer_dynamic_sampling               2
optimizer_features_enable                11.2.0.1
optimizer_index_caching                  0
optimizer_index_cost_adj                 100
optimizer_mode                           all_rows
optimizer_secure_view_merging            true
optimizer_use_invisible_indexes          false
optimizer_use_pending_statistics         false
optimizer_use_sql_plan_baselines         true
parallel_autodop                         0
parallel_ddl_mode                        enabled
parallel_ddldml                          0
parallel_degree                          0
parallel_degree_limit                    65535
parallel_degree_policy                   manual
parallel_dml_mode                        disabled
parallel_execution_enabled               true
parallel_force_local                     false
parallel_max_degree                      16
parallel_min_time_threshold              10
parallel_query_default_dop               0
parallel_query_mode                      enabled
parallel_threads_per_cpu                 2
pga_aggregate_target                     2048000 KB
query_rewrite_enabled                    true
query_rewrite_integrity                  enforced
result_cache_mode                        MANUAL
skip_unusable_indexes                    true
sort_area_retained_size                  0
sort_area_size                           65536
star_transformation_enabled              false
statistics_level                         typical
total_cpu_count                          8
transaction_isolation_level              read_commited
workarea_size_policy                     auto

—

I know that this was just a quick demo, but why can’t I create a new user now?
Continuing immediately after creating the trigger:

Trigger created.

SQL> CREATE USER TESTUSER IDENTIFIED BY CRASH;
CREATE USER TESTUSER IDENTIFIED BY CRASH
*
ERROR at line 1:
ORA-00604: error occurred at recursive SQL level 1
ORA-28103: adding a policy to an object owned by SYS is not allowed
ORA-06512: at "SYS.DBMS_RLS", line 20
ORA-06512: at line 3


SQL> DROP TRIGGER DDL_TRIG;

Trigger dropped.

SQL> CREATE USER TESTUSER IDENTIFIED BY CRASH;

User created.

There is a way to check the type of object that is being created, so it would be possible to make certain that the policy is only automatically applied to tables that are being created. For those who decide to try this experiment, please make certain that you drop the trigger after the experiment ends.

CREATE OR REPLACE PACKAGE my_select_package AS
FUNCTION my_select_rownum (p_schema in varchar2,
                      p_object in varchar2 ) return varchar2;
END my_select_package;
/

CREATE OR REPLACE PACKAGE BODY my_select_package AS
function my_select_rownum( p_schema in varchar2,
                                p_object in varchar2 ) return varchar2
as
PRAGMA AUTONOMOUS_TRANSACTION;
begin
return ' rownum < 101';
end;
END my_select_package;
/

CREATE OR REPLACE TRIGGER ddl_trig
AFTER DDL
ON DATABASE
BEGIN
if ora_sysevent = 'CREATE' THEN
  dbms_rls.add_policy
    ( object_schema   => ora_dict_obj_owner,
    object_name     => ora_dict_obj_name,
    policy_name     => 'MY_SELECT_TRIGGER',
    function_schema => 'SYS',
    policy_function => 'MY_SELECT_PACKAGE.MY_SELECT_ROWNUM',
    statement_types => 'select' ,
    update_check    => FALSE );
  END IF;
END ddl_trig;
/

assume (for whatever reason) this package and trigger exists in the sandbox-DB where you are running the tests:

CREATE OR REPLACE PACKAGE my_select_package AS
FUNCTION my_select_rownum (p_schema in varchar2,
                      p_object in varchar2 ) return varchar2;
END my_select_package;
/
 
CREATE OR REPLACE PACKAGE BODY my_select_package AS
function my_select_rownum( p_schema in varchar2,
                                p_object in varchar2 ) return varchar2
as
begin
return ' rownum  ora_dict_obj_owner,
    object_name     => ora_dict_obj_name,
    policy_name     => 'MY_SELECT_TRIGGER',
    function_schema => 'SYS',
    policy_function => 'MY_SELECT_PACKAGE.MY_SELECT_ROWNUM',
    statement_types => 'select' ,
    update_check    => FALSE );
  END IF;
 
END ddl_trig;
/

with this approach you can do nearly anything. With some more logic and a status table you can even give all answers in a row, for each repeated test run.

How else might you obtain the “wrong” answers for the test question?

Good question regarding the goal of this quiz. Several years ago I was state certified to teach mathematics and computer science classes. One of the interesting parts of teaching is discovering how an answer other than the “right” answer was obtained by the people taking a particular test – more or less by reviewing the work of the person answering the questions it is quite possible to discover that more than one answer is correct.

I read Cary Millsap’s recent blog articles about showing one’s work (the intermediate steps to the answer), heard about some of the difficulties with the PL/SQL Challenge mentioned by Gary, and I am currently reading Tom Kyte’s latest book – those were the inspirations for this blog article. I thought that this quiz would offer a chance to stop, think, and understand how the different answers might be obtained – that 100 number is hard to obtain.

All 3 of the sessions were connected at the start of the test script. What are some of the items that we do not know (that were not already mentioned):
* Were the sessions connected using SQL*Plus or something like JDBC, ODBC, or ADO that automatically commits by default
* Were the sessions, if SQL*Plus was used, closed after executing each set of commands
* You and Joel mentioned serializable – do we know if the sessions were just connected to the database, or could it be possible that the sessions had just completed another experiment that left an in-process transaction in place.
* What do we know about the pre-existing database – there might be views and public synonyms hanging around.

———————
Edit:
The original comment was posted using a netbook with a very small screen – I must have over-looked some of Martin’s response when typing the last bullet point. The question is more or less how is it possible to obtain different answers for this particular multiple choice question. Martin, I would like to see the answers using FGA and the other solutions that you develop.

If I had just 60 seconds to answer the question, I would try to produce an answer as clearly written as the first comment. If I had more than 60 seconds to answer the question I would consider picking one of the other answers…

What if… this is not an Oracle database? The CONNECT BY LEVEL syntax is probably Oracle Database specific, but what if it were not (or an equivalent syntax were used) and the database was actually SQL Server, Informix, or Sybase that commit by default after every DML statement (reference page 284 in Tom Kyte’s latest book).

I noticed that if I didn’t have all the sessions going at the start of the test, it was 0. If I did, it was 200. But the question seems to say all three sessions would be going at the beginning of the test.

Oooooohhh… Statement level transaction consistency, each session sees the db as of the start of its own transaction. So that can depend on other unstated factors… like what-all you have in a global or local sql login file.

I would have answered b had I not tried it. But I still have a nagging feeling I’m forgetting about something else.

In 11gR2, with deferred segment creation, you can have the strange situation where you can successfully create a table (in your default tablespace) but not have any quota on it. In which case any attempt to insert will fail (when it tries to create the segment). So case (D) can be the answer. Oh, and in 8.0 (maybe 8i) the CONNECT BY LEVEL didn’t work, so that would give (D) as well

Haven’t worked out how to get (C) yet without some sort of constraint.

You can probably cheat with your own version

That was a very quick answer. I will wait a couple of days before stating which answer is correct (I must have the correct answer if I designed the test question, right?).

This question seems to be very specific, yet ask yourself what the question does not state.