Oracle Data Redaction和Oracle Data Pump

dingdingfish2023-11-21 15:23

本实验的使用环境基于之前的博客：一个简单的Oracle Redaction实验

本实验参考文档为15.14 Oracle Data Redaction and Oracle Data Pump

先创建directory并赋权：

sql 复制代码 
-- connect to database or pluggable database
alter session set container=orclpdb1;
CREATE OR REPLACE DIRECTORY test_dir AS '/u01/app/oracle/oradata/';
GRANT READ, WRITE ON DIRECTORY test_dir TO schema_user;

先以schema_user用数据泵导出：

bash 复制代码 
$ expdp schema_user@orclpdb1 tables=employees directory=TEST_DIR dumpfile=expdp.dmp

Export: Release 19.0.0.0.0 - Production on Mon Nov 20 08:13:33 2023
Version 19.20.0.0.0

Copyright (c) 1982, 2019, Oracle and/or its affiliates.  All rights reserved.
Password:

Connected to: Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Starting "SCHEMA_USER"."SYS_EXPORT_TABLE_01":  schema_user/********@orclpdb1 tables=employees directory=TEST_DIR dumpfile=expdp.dmp
Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
Processing object type TABLE_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
Processing object type TABLE_EXPORT/TABLE/STATISTICS/MARKER
Processing object type TABLE_EXPORT/TABLE/TABLE
ORA-31693: Table data object "SCHEMA_USER"."EMPLOYEES" failed to load/unload and is being skipped due to error:
ORA-28081: Insufficient privileges - the command references a redacted object.

Master table "SCHEMA_USER"."SYS_EXPORT_TABLE_01" successfully loaded/unloaded
******************************************************************************
Dump file set for SCHEMA_USER.SYS_EXPORT_TABLE_01 is:
  /u01/app/oracle/oradata/expdp.dmp
Job "SCHEMA_USER"."SYS_EXPORT_TABLE_01" completed with 1 error(s) at Mon Nov 20 08:13:48 2023 elapsed 0 00:00:12

出错了，错误为：

bash 复制代码 
$ oerr ora 28081
28081, 00000, "Insufficient privileges - the command references a redacted object."
// *Cause: The command referenced a redacted column in an
// object protected by a data redaction policy.
// *Action: If possible, modify the command to avoid referencing any
// redacted columns.  Otherwise, drop the data redaction policies that
// protect the referenced tables and views, or ensure that the user issuing
// the command has the EXEMPT REDACTION POLICY system privilege, then
// retry the operation.  The EXEMPT REDACTION POLICY system privilege
// is required for creating or refreshing a materialized view when the
// materialized view is based on an object protected by a data redaction
// policy.  The EXEMPT REDACTION POLICY system privilege is required for
// performing a data pump schema-level export including any object
// protected by a data redaction policy.  All data redaction policies are
// listed in the REDACTION_COLUMNS catalog view.

关键的错误是：

The EXEMPT REDACTION POLICY system privilege is required for performing a data pump schema-level export including any object protected by a data redaction policy.

执行数据泵架构级导出（包括受数据编辑策略保护的任何对象）需要 EXEMPT REDACTION POLICY 系统权限。

简单来说就是，想利用Data Redaction实现数据泵导出的脱敏是做不到的，因为其实质上是物理脱敏。因此，要么你绕过redact policy（利用EXEMPT REDACTION POLICY权限），要么你只导出元数据。

绕过redact policy可以用特权用户，如SYS：

bash 复制代码 
$ expdp system@orclpdb1 tables=schema_user.employees directory=TEST_DIR dumpfile=expdp.dmp

Export: Release 19.0.0.0.0 - Production on Mon Nov 20 08:20:26 2023
Version 19.20.0.0.0

Copyright (c) 1982, 2019, Oracle and/or its affiliates.  All rights reserved.
Password:

Connected to: Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Starting "SYSTEM"."SYS_EXPORT_TABLE_01":  system/********@orclpdb1 tables=schema_user.employees directory=TEST_DIR dumpfile=expdp.dmp
Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
Processing object type TABLE_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
Processing object type TABLE_EXPORT/TABLE/STATISTICS/MARKER
Processing object type TABLE_EXPORT/TABLE/TABLE
Processing object type TABLE_EXPORT/TABLE/RADM_POLICY
. . exported "SCHEMA_USER"."EMPLOYEES"                   6.929 KB       2 rows
Master table "SYSTEM"."SYS_EXPORT_TABLE_01" successfully loaded/unloaded
******************************************************************************
Dump file set for SYSTEM.SYS_EXPORT_TABLE_01 is:
  /u01/app/oracle/oradata/expdp.dmp
Job "SYSTEM"."SYS_EXPORT_TABLE_01" successfully completed at Mon Nov 20 08:20:41 2023 elapsed 0 00:00:11

绕过redact policy的数据泵导出的是原始数据：

bash 复制代码 
$ strings /u01/app/oracle/oradata/expdp.dmp |grep '247-85-9056'
247-85-9056

文档里也提到了：

This means that, when you export objects with Data Redaction policies defined on them, the actual data in the protected tables is copied to the Data Pump target system without being redacted.

不过redact policy会被一并导出。

利用数据泵导入，验证redact policy也包含在数据泵导出中。

bash 复制代码 
$ impdp system@orclpdb1 tables=schema_user.employees directory=TEST_DIR dumpfile=expdp.dmp remap_table=employees:employees_new

Import: Release 19.0.0.0.0 - Production on Mon Nov 20 08:35:03 2023
Version 19.20.0.0.0

Copyright (c) 1982, 2019, Oracle and/or its affiliates.  All rights reserved.
Password:

Connected to: Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Master table "SYSTEM"."SYS_IMPORT_TABLE_01" successfully loaded/unloaded
Starting "SYSTEM"."SYS_IMPORT_TABLE_01":  system/********@orclpdb1 tables=schema_user.employees directory=TEST_DIR dumpfile=expdp.dmp remap_table=employees:employees_new
Processing object type TABLE_EXPORT/TABLE/TABLE
Processing object type TABLE_EXPORT/TABLE/RADM_POLICY
ORA-39083: Object type RADM_POLICY failed to create with error:
ORA-28069: A data redaction policy already exists on this object.

Failing sql is:
BEGIN DBMS_REDACT.ADD_POLICY(object_schema => '"SCHEMA_USER"', object_name => '"EMPLOYEES"', policy_name => 'redact_policy', expression => '1=1', enable => TRUE);
DBMS_REDACT.ALTER_POLICY (object_schema => '"SCHEMA_USER"', object_name => '"EMPLOYEES"', policy_name => 'redact_policy', action => DBMS_REDACT.ADD_COLUMN, column_name => '"SOCIAL_SECURITY"', function_type => DBMS_REDACT.RANDOM, function_parameters => NULL);
END;

Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
. . imported "SCHEMA_USER"."EMPLOYEES_NEW"               6.929 KB       2 rows
Processing object type TABLE_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
Processing object type TABLE_EXPORT/TABLE/STATISTICS/MARKER
Job "SYSTEM"."SYS_IMPORT_TABLE_01" completed with 1 error(s) at Mon Nov 20 08:35:21 2023 elapsed 0 00:00:15

出错了，原因是由于原表的redact policy已存在。那我们就先删除此policy。

然后导入就没问题了：

bash 复制代码 
$ impdp system@orclpdb1 tables=schema_user.employees directory=TEST_DIR dumpfile=expdp.dmp remap_table=employees:employees_new

Import: Release 19.0.0.0.0 - Production on Mon Nov 20 08:39:58 2023
Version 19.20.0.0.0

Copyright (c) 1982, 2019, Oracle and/or its affiliates.  All rights reserved.
Password:

Connected to: Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Master table "SYSTEM"."SYS_IMPORT_TABLE_01" successfully loaded/unloaded
Starting "SYSTEM"."SYS_IMPORT_TABLE_01":  system/********@orclpdb1 tables=schema_user.employees directory=TEST_DIR dumpfile=expdp.dmp remap_table=employees:employees_new
Processing object type TABLE_EXPORT/TABLE/TABLE
Processing object type TABLE_EXPORT/TABLE/RADM_POLICY
Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
. . imported "SCHEMA_USER"."EMPLOYEES_NEW"               6.929 KB       2 rows
Processing object type TABLE_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
Processing object type TABLE_EXPORT/TABLE/STATISTICS/MARKER
Job "SYSTEM"."SYS_IMPORT_TABLE_01" successfully completed at Mon Nov 20 08:40:06 2023 elapsed 0 00:00:05

导入后，我们发现策略也导入了：

sql 复制代码 
SQL> select count(*) from redaction_policies;

  COUNT(*)
----------
         1
相关推荐
百度智能云技术站11 小时前
广告投放系统成本降低 70%+，基于 Redis 容量型数据库 PegaDB 的方案设计和业务实践
数据库·redis·oracle
梦想平凡13 小时前
PHP 微信棋牌开发全解析：高级教程
android·数据库·oracle
夏木~15 小时前
Oracle 中什么情况下 可以使用 EXISTS 替代 IN 提高查询效率
数据库·oracle
吴冰_hogan16 小时前
MySQL InnoDB 存储引擎 Redo Log（重做日志）详解
数据库·oracle
CodeCraft Studio16 小时前
【实用技能】如何在 SQL Server 中处理 Null 或空值？
数据库·oracle·sqlserver
武汉联从信息17 小时前
浅谈ORACLE中间件SOA BPM,IDM,OID,UCM,WebcenterPortal服务器如何做迁移切换
oracle
Elastic 中国社区官方博客18 小时前
Elasticsearch：什么是查询语言？
大数据·数据库·elasticsearch·搜索引擎·oracle
夜光小兔纸19 小时前
oracle dblink 的创建及使用
数据库·oracle
Smile丶凉轩19 小时前
MySQL库的操作
数据库·mysql·oracle
p@nd@21 小时前
Oracle筑基篇-调度算法-LRU的引入
数据库·oracle·操作系统·lru
热门推荐
01〔AI 绘画〕Stable Diffusion 之 解决绘制多人或面部很小的人物时面部崩坏问题 篇02ARM学习（31）编译器对overlay方式的支持03玄机平台应急响应—webshell查杀04DisplayPort AltMode On Type-c协议_Ver2.0(学习笔记)05校验 GPT-4 真实性的三个经典问题：快速区分 GPT-3.5 与 GPT-4，并提供免费测试网站06Docker 夺命连环 15 问076个主流的工业3D管道设计软件08基于大语言模型（LLM）的合成数据生成、策展和评估的综述09(欧拉)openEuler系统添加网卡文件配置流程、(欧拉)openEuler系统手动配置ipv6地址流程、(欧拉)openEuler系统网络管理说明10红米手机使用google play