Step 1: Register Oracle Label Security and Enable the LBACSYS Account

In a default Oracle Database installation, Oracle Label Security is installed. However, you must register Oracle Label Security and then enable the default Oracle Label Security account, which is called LBACSYS.

Registering Oracle Label Security with Oracle Database
Enabling the Default Oracle Label Security User Account LBACSYS

Registering Oracle Label Security with Oracle Database

After you complete the installation, you must register Oracle Label Security with Oracle Database. You can check if Oracle Label Security is already registered by entering the following SELECT statement in SQL*Plus. The PARAMETER column is case sensitive, so use the case shown here.

SELECT * FROM V$OPTION WHERE PARAMETER = 'Oracle Label Security';

If the output is TRUE, then Oracle Label Security has been registered. Go to "Enabling the Default Oracle Label Security User Account LBACSYS". If it is FALSE, then register Oracle Label Security.

To register Oracle Label Security with Oracle Database:

Stop the database, Database Control console process, and listener.
- UNIX: Log in to SQL*Plus as user SYS with the SYSOPER privilege and shut down the database. Then from the command line, stop the Database Control console process and listener.
  
  For example:
```
sqlplus sys as sysoper
Enter password: password

SQL> SHUTDOWN IMMEDIATE
SQL> EXIT

$ emctl stop dbconsole
$ lsnrctl stop [listener_name]
```
  For Oracle RAC installations, shut down each database instance as follows:
```
$ srvctl stop database -d db_name
```
- Windows: Stop the database, Database Control console process, and listener from the Services tool in the Control Panel. The names of Oracle Database services begin with Oracle.
Enable Oracle Label Security as follows:
- UNIX: Run the following commands:
```
$ cd $ORACLE_HOME/rdbms/lib
$ make -f ins_rdbms.mk lbac_on ioracle
```
- Windows: In the ORACLE_BASE\ORACLE_HOME\bin directory, rename the oralbacll.dll.dbl file to oralbacll.dll.
Restart the database and listener. (Do not restart the Database Control console process yet.)
- UNIX: Log in to SQL*Plus as user SYS with the SYSOPER privilege and restart the database. Then from the command line, restart the listener.
  
  For example:
```
sqlplus sys as sysoper
Enter password: password

SQL> STARTUP
SQL> EXIT

$ lsnrctl start [listener_name]
```
  For Oracle RAC installations, restart each database instance as follows:
```
$ srvctl start database -d db_name
```
- Windows: Restart the database and listener from the Services tool in the Control Panel. The names of Oracle Database services begin with Oracle.
Start Database Configuration Assistant.
- UNIX: Enter the following command at a terminal window:
```
dbca
```
  Typically, dbca is in the $ORACLE_HOME/bin directory.
- Windows: From the Start menu, click All Programs. Then, click Oracle - ORACLE_HOME, Configuration and Migration Tools, and then Database Configuration Assistant.
  
  Alternatively, you can start Database Configuration Assistant at a command prompt:
```
dbca
```
  As with UNIX, typically, dbca is in the ORACLE_BASE\ORACLE_HOME\bin directory.
In the Welcome page, click Next.

The Operations page appears.
Select Configure Database Options, and then click Next.

The Database page appears.
From the list, select the database where you installed Oracle Database and then enter the name and password of a user who has been granted the DBA role (for example, user SYS). Click Next.

The Database Content page appears.
Select Oracle Label Security and then click Next.

The Connection Mode page appears.
Select either Dedicated Server Mode or Shared Server Mode (depending on the selection you made when you created this database), click Finish, and then click OK in the confirmation prompts.

Database Configuration Assistant registers Oracle Label Security, and then restarts the database instance.
Exit Database Configuration Assistant.
Restart the Database Control console process.
- UNIX: Run the following command:
```
$ emctl start dbconsole
```
- Windows: Restart the Database Control console process (for example, OracleDBConsoleorcl if the database is named orcl) from the Services tool in the Control Panel.

Enabling the Default Oracle Label Security User Account LBACSYS

The Oracle Label Security installation process creates a default user account, LBACSYS, who manages the Oracle Label Security features. An administrator can create a user who has the same privileges as this user, that is, EXECUTE privileges on the SA_SYSDBA, SA_COMPONENTS, and SA_LABEL_ADMIN PL/SQL packages. By default, LBACYS is created as a locked account with its password expired. Your next step is to unlock LBACYS and create a new password. Because user LBACSYS is using Database Control to create the Oracle Label Security policy, you must grant the SELECT ANY DICTIONARY privilege to LBACSYS.

To enable the LBACSYS user account:

Log in to Database Control as the user SYS with the SYSDBA privilege.
Click Server to display the Server subpage.
Under Security, select Users.

The Users page appears.
Select the LBACSYS user, and in the View User page, click Edit.

The Edit User page appears.
Next to Status, select Unlocked.
In the Enter Password and Confirm Password fields, enter a secure password, according to the guidelines in "Requirements for Creating Passwords".

For greater security, do not reuse the same password that was used in previous releases of Oracle Database.
Click Roles to display the Edit User: LBACSYS page.
Click Edit List.

The Modify Roles page appears.
In the Available Roles list, select the SELECT_CATALOG_ROLE role and then then click Move to move it to the Selected Roles list. Then click OK to return to the Edit User page.
Click System Privileges.
Click Edit List.

The Modify System Privileges page appears.
In the Available System Privileges list, select SELECT ANY DICTIONARY, and then click Move to move it to the Selected System Privileges list. Then click OK to return to the Edit User page.
Select Object Privileges.
In the Select Object Type list, select Package and then click Add.
In the Add Package Object Privileges page, do the following:
1. Under Select Package Objects, select the flashlight icon to display the Select Package Objects window.
2. Set the Schema to LBACSYS.
3. Enter % in the Search Package Name field and then click Go.
4. Select all the package objects listed, for both pages of listed objects.
5. Click Select to return to the Add Package Object Privileges window.
6. Under Available Privileges, move the EXECUTE privilege to the Selected Privileges list.
7. Click OK.
Click OK to return to the Edit User page, and then click Apply to apply the changes.

Step 1: Register Oracle Label Security and Enable the LBACSYS Account

Related Topics