Modifications to Oracle SQL Firewall Configurations

2.1.2 Modifications to Oracle SQL Firewall Configurations

After you create an Oracle SQL Firewall configuration for a user, you can modify the configuration as necessary.

To find information about Oracle SQL Firewall configurations, you can query the DBA_SQL_FIREWALL_* data dictionary views.

Table 2-1 lists operations that you can perform after you have configured SQL Firewall.

Table 2-1 Oracle SQL Firewall Modification Procedures

Operation	Procedure
Enable SQL Firewall	To enable SQL Firewall in the database, use `DBMS_SQL_FIREWALL.ENABLE`.
Manage captures	To create a capture, use `DBMS_SQL_FIREWALL.CREATE_CAPTURE`. To start a capture, use `DBMS_SQL_FIREWALL.START_CAPTURE`. To modify a capture, delete the current one by using `DBMS_SQL_FIREWALL.DROP_CAPTURE`, and then create a new one by using `DBMS_SQL_FIREWALL.CREATE_CAPTURE`. To stop the SQL Firewall capture for the specified user, use `DBMS_SQL_FIREWALL.STOP_CAPTURE`. To delete the SQL Firewall capture for a specified user and delete all the existing capture logs for this user: Use `DBMS_SQL_FIREWALL.STOP_CAPTURE` to stop the capture process. Use `DBMS_SQL_FIREWALL.DROP_CAPTURE` to remove the capture.
Manage allow-lists	To generate an allow-list for a given user, use `DBMS_SQL_FIREWALL.GENERATE_ALLOW_LIST`. To enable an allow-list for a given user, use `DBMS_SQL_FIREWALL.ENABLE_ALLOW_LIST`. To update an allow-list enforcement, use `DBMS_SQL_FIREWALL.UPDATE_ALLOW_LIST_ENFORCEMENT`. To prevent SQL Firewall from capturing and enforcing allow-lists for database connections and SQL executions in Oracle Scheduler jobs, use `DBMS_SQL_FIREWALL.EXCLUDE`. To append all the SQL from a capture log or violation log (or from both) to the allow-list, use the `DBMS_SQL_FIREWALL.APPEND_ALLOW_LIST` procedure. You can run this procedure when the allow-list is either enabled or disabled. The change takes place immediately. To append a single SQL record from a capture log or violation log to the allow-list, use the `DBMS_SQL_FIREWALL.APPEND_ALLOW_LIST_SINGLE_SQL` procedure as follows: Query the `DBA_SQL_FIREWALL_VIOLATIONS` or the `DBA_SQL_FIREWALL_CAPTURE_LOGS` data dictionary view to find the target SQL record that you want to add to the allow-list. Enter the obtained `USERNAME`, `SQL_SIGNATURE`, `CURRENT_USER`, and `TOP_LEVEL` values of that record in the `DBMS_SQL_FIREWALL.APPEND_ALLOW_LIST_SINGLE_SQL` procedure to add the target SQL record to the allow-list. You can run `DBMS_SQL_FIREWALL.APPEND_ALLOW_LIST_SINGLE_SQL` when the allow-list is either enabled or disabled. The change takes place immediately. To export the allow-list of a given user to JSON format into the specified CLOB, use `DBMS_SQL_FIREWALL.EXPORT_ALLOW_LIST`. To import the allow-list for a given user into a target database, use `DBMS_SQL_FIREWALL.IMPORT_ALLOW_LIST`. To disable an allow-list for a given user, use `DBMS_SQL_FIREWALL.DISABLE_ALLOW_LIST`. To add or delete any context values from allowed context lists, use `DBMS_SQL_FIREWALL.ADD_ALLOWED_CONTEXT` or `DBMS_SQL_FIREWALL.DELETE_ALLOWED_CONTEXT`, respectively. To delete any SQL statement from allowed SQL lists, use `DBMS_SQL_FIREWALL.DELETE_ALLOWED_SQL`. To delete the allow-list for a specified user: Disable the allow-list by using `DBMS_SQL_FIREWALL.DISABLE_ALLOW_LIST`. Use `DBMS_SQL_FIREWALL.DROP_ALLOW_LIST`.
Manage allowed contexts	To add a specified value to the allowed contexts of a specified user for the given context type, use `DBMS_SQL_FIREWALL.ADD_ALLOWED_CONTEXT`. To modify an allowed context, delete the current one by using `DBMS_SQL_FIREWALL.DELETE_ALLOWED_CONTEXT`, and then create a new one by using `DBMS_SQL_FIREWALL.ADD_ALLOWED_CONTEXT`. To delete the specified value from the allowed contexts of a specified user for the given context type, use `DBMS_SQL_FIREWALL.DELETE_ALLOWED_CONTEXT`.
Manage allowed SQL	To delete the specified entry from the allowed SQL of a specified user, use `DBMS_SQL_FIREWALL.DELETE_ALLOWED_SQL`. You can run this procedure when the allow-list is either enabled or disabled, and the change takes place immediately.
Manage SQL Firewall log tables	To move the SQL Firewall log tables to a different user-defined tablespace other than the default tablespace, `SYSAUX`: Disable SQL Firewall by using `DBMS_SQL_FIREWALL.DISABLE`. Use the `MOVE` clause of the `ALTER TABLE` statement to perform the move operation. You can also use the `DBMS_SQL_FIREWALL.MOVE_LOG_TABLE` procedure to move the SQL Firewall log tables to another tablespace. To purge capture logs or violation logs for a user or all users, use `DBMS_SQL_FIREWALL.PURGE_LOG`. To flush all the SQL Firewall logs that reside in the memory into the log tables, use `DBMS_SQL_FIREWALL.FLUSH_LOGS`.
Disable SQL Firewall	To disable SQL Firewall in the database and stop all the existing captures and allow-lists that are enabled, use `DBMS_SQL_FIREWALL.DISABLE`.

Related Topics