Home » SQL & PL/SQL » SQL & PL/SQL » ORA-2014 on RLS-enabled table with double FGA policy (RDBMS 11.2.0.3, Windows 2008 R2, 64-bit)
| ORA-2014 on RLS-enabled table with double FGA policy [message #639586] |
Fri, 10 July 2015 14:43 |
 |
Alien
Messages: 292 Registered: June 1999
|
Senior Member |
|
|
Hi guys,
I just opened an SR with Oracle for a strange situation.
By accident we created 2 FGA policies on one table. This table has an RLS security policy (not 100% sure if it is relevant, but still testing).
On performing a select with outer join to that table, we get an ORA-02014: cannot select FOR UPDATE from view with DISTINCT, GROUP BY, etc.
Note that this involves only base tables. No views, no in-line views, no nested tables, and no distinct/group by statements.
The outer join to this table is relevant, other joins are working as expected. There is no difference between an ansi-join and old-skool outer join.
The RLS policy adds a predicate referencing sys_context.
So far we can only reproduce on one table. We're still working on a reproducible test case. But I'm just wondering if somebody has encountered this before:
SQL> connect apps@ofac
Verbonden.
SQL> select * from v$version;
BANNER
--------------------------------------------------------------------------------
Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64bit Production
PL/SQL Release 11.2.0.3.0 - Production
CORE 11.2.0.3.0 Production
TNS for 64-bit Windows: Version 11.2.0.3.0 - Production
NLSRTL Version 11.2.0.3.0 - Production
SQL> begin
2 mo_global.init('PO');
3 end;
4 /
PL/SQL-procedure is geslaagd.
SQL> SELECT 1
2 FROM po_line_locations PLL,
3 po_distributions POD
4 WHERE PLL.po_header_id = 1542538
5 AND PLL.line_location_id = POD.line_location_id (+)
6 FOR UPDATE NOWAIT;
1
----------
1
1
1
1
1
SQL> connect system@ofac
Verbonden.
SQL> begin
2 dbms_fga.add_policy(object_schema=>'PO',object_name=>'PO_DISTRIBUTIONS_ALL',policy_name=>'PO_DISTRIBUTIONS_ALL1',statement_types=>'SELECT,INSERT,UPDATE,DELETE');
3 end;
4 /
PL/SQL-procedure is geslaagd.
SQL> begin
2 dbms_fga.add_policy(object_schema=>'PO',object_name=>'PO_DISTRIBUTIONS_ALL',policy_name=>'PO_DISTRIBUTIONS_ALL2',statement_types=>'INSERT,UPDATE,DELETE');
3 end;
4 /
PL/SQL-procedure is geslaagd.
SQL> connect apps@ofac
Verbonden.
SQL> begin
2 mo_global.init('PO');
3 end;
4 /
PL/SQL-procedure is geslaagd.
SQL> SELECT 1
2 FROM po_line_locations PLL,
3 po_distributions POD
4 WHERE PLL.po_header_id = 1542538
5 AND PLL.line_location_id = POD.line_location_id (+)
6 FOR UPDATE NOWAIT;
po_distributions POD
*
FOUT in regel 3:
.ORA-02014: Kan FOR UPDATE niet kiezen uit view met DISTINCT, GROUP BY, etc.
SQL> connect system@ofac
Verbonden.
SQL> begin
2 dbms_fga.drop_policy(object_schema=> 'PO',object_name=>'PO_DISTRIBUTIONS_ALL',policy_name=>'PO_DISTRIBUTIONS_ALL1');
3 end;
4 /
PL/SQL-procedure is geslaagd.
SQL> connect apps@ofac
Verbonden.
SQL>
SQL> begin
2 mo_global.init('PO');
3 end;
4 /
PL/SQL-procedure is geslaagd.
SQL>
SQL> SELECT 1
2 FROM po_line_locations PLL,
3 po_distributions POD
4 WHERE PLL.po_header_id = 1542538
5 AND PLL.line_location_id = POD.line_location_id (+)
6 FOR UPDATE NOWAIT;
1
----------
1
1
1
1
1
SQL> spool off;
We're aware of note: 452303.1. But this does not involve a nested table. We'll be testing the patch next week, anyway.
For us the issue is easily resolved by dropping the second FGA policy, but I'd like to know the root cause. So I'm testing with/without RLS, tables with different statistics/expected explain plans. But I can't find a reasonable explanation yet.
Does anybody have any thoughts for further testing or for the root cause of this?
Regards,
Arian
|
|
|
|
Goto Forum:
Current Time: Sun Aug 09 04:49:38 CDT 2026
|