ORA-39181:Only Partial Table Data Exported Due To Fine Grain Access Control [ID 422480.1]
2012-02-07 10:10
603 查看
修改时间 15-MAR-2011 类型 PROBLEM 状态 PUBLISHED |
Symptoms
Changes
Cause
Solution
References
Applies to:
Oracle Server - Enterprise Edition - Version: 10.2.0.1 and later [Release: 10.2 and later ]Information in this document applies to any platform.
Checked for relevance on 15-Mar-2011
Symptoms
ERROR:ORA-39181 :only partial table data may be exported due to fine grain access control
This error appears trying to datapump export a table with FGAC policy enabled against it.
When Expdp runs as the schema owner, if fine grained policies are discovered on tables and if the exporting user has unrestricted access, then the entire table data is exported.
Changes
A table with FGAC policy enabled against it.Scenario 1 (unprivileged user)
------------------------------
table: ABC_TAB
partition=yes
table_owner= X_USER
data= 500GB
when expdp X_USER/password parameter=exp_ABC_TAB.par
==>
Getting ORA-39181: Only partial table data may be exported due to fine grain access control
Scenario 2 (privileged user)
-----------------------------
table: ABC_TAB
partition=yes
table_owner= X_USER
when expdp oradba/password parameter=exp_ABC_TAB.par
==>
Getting exported "X_USER"."ABC_TAB":"ABC_TAB_AA"12340 KB 1000 rows
Master table "ORADBA"."ABC_TAB_AA" successfully loaded/unloaded
Cause
This is expected behavior.ORA-39181 is caused by an unprivileged user who tries to export a table with a fine grain access control policiy applied. The table owner is subject to access control and may not be able to export all rows in the table. Only the rows that can be seen by
that user are exported. In order to preserve integrity of the table, the user importing the table should have enough privilege to recreate the table with the security policies at import time.
Action: It is strongly recommended that the database administrator handles the export of this table.
This as an informational message.
VPD and Oracle Label Security are not enforced during DIRECT path export and similarly, database users granted the EXEMPT ACCESS POLICY privilege, either directly or through a database role, are exempt from VPD enforcements. However, the following policy enforcement
options remain in effect even when EXEMPT ACCESS POLICY is granted:
* INSERT_CONTROL, UPDATE_CONTROL, DELETE_CONTROL, WRITE_CONTROL, LABEL_UPDATE, and LABEL_DEFAULT
EXEMPT ACCESS POLICY is a strong privilege and must be granted with care. For example , grant it to the role exp_full_database role as this role is granted to admin users only.
Solution
To avoid this:Grant the privilege EXEMPT ACCESS POLICY to the exporting user
-or-
Disable the VPD policy.
References
NOTE:174799.1 - How to Bypass Fine-Grained Security EnforcementNOTE:304137.1 - ORA-12406 When Updating a Table With an OLS Policy Though Granted EXEMPT ACCESS POLICY Privilege
相关文章推荐
- ORA-39181: Only partial table data may be exported due to fine grain access control on "OE"."PURCHAS
- ORA-39181: Only partial table data may be exported due to fine grain access control on "OE"."PURCHAS
- expdp ORA-39181:Only Partial Table Data Exported Due To Fine Grain Access Control
- oracle 11.2.0.3 expdp 时报错,ORA-39181: Only partial table data may be exported due to fine grain
- High Waits on 'Db File Sequential Read' Due to Table Lookup Following Index Access (文档 ID 875472.1)
- ORA-00604 ORA-00376 Unable to Drop a tablespace in GoldenGate (文档 ID 1930964.1)
- Export/Import DataPump Parameter ACCESS_METHOD - How to Enforce a Method of Loading and Unloading Data ? [ID 552424.1]
- user master page with asp:FormParameter , save only blank data to Database MSAccess
- Export/Import DataPump Parameter ACCESS_METHOD - How to Enforce a Method of Loading and Unloading Data ? [ID 552424.1]
- DBSPI40-1: Unable to fetch data from table 'V$SYSSTAT' [ORA-03135: connection lost contact]
- user master page with asp:FormParameter , save only blank data to Database MSAccess
- ORA-01466: unable to read data - table definition has changed
- ORA-14450 attempt to access a transactional temp table already in use
- Export/Import DataPump Parameter ACCESS_METHOD - How to Enforce a Method of Loading and Unloading Data ? [ID 552424.1]
- ORA-01466: unable to read data - table definition has changed
- SQLException: ORA-01653: unable to extend table ... by 1024 in tablespace RISK_DATA
- Export/Import DataPump Parameter ACCESS_METHOD - How to Enforce a Method of Loading and Unloading Data ? [ID 552424.1]
- ORA-14450: attempt to access a transactional temp table already in use
- ORA-31693:Table data object xxx failed to load
- Enterprise Manager Database Control Configuration - Errors Due to CA Expiry (文档 ID 1222603.1)