Label security enables fine-grained access to individual table rows.
Applicability
This topic applies only to OceanBase Database Enterprise Edition. OceanBase Database Community Edition provides only MySQL mode.
A label security policy has a set of standard components, including:
Label
This component contains labels for data and users, as well as authorizations for users and program units. It manages access to specified protected objects. Labels contain only levels in the current version. A level indicates the sensitivity assigned to a row, for example,
SENSITIVEorHIGHLY SENSITIVE.Policy
A policy is the name that is associated with the labels, rules, authorizations, and protected tables.
The following table describes the label security management packages supported by the current OceanBase Database version.
| Package | Description |
|---|---|
| SA_SYSDBA | Creates, alters, and drops label security policies. |
| SA_COMPONENTS | Defines the levels of policies. |
| SA_LABEL_ADMIN | Performs standard label policy management, such as creating labels. |
| SA_POLICY_ADMIN | Applies policies to schemas and tables. |
| SA_USER_ADMIN | Manages user authorizations for levels, as well as program unit privileges and user privileges. |
| SA_SESSION | Changes labels during a session within the authorization scope configured by the administrator. |