Home » SQL & PL/SQL » SQL & PL/SQL » ORA-2014 on RLS-enabled table with double FGA policy (RDBMS 11.2.0.3, Windows 2008 R2, 64-bit)
ORA-2014 on RLS-enabled table with double FGA policy [message #639586] Fri, 10 July 2015 14:43
Alien
Messages: 292
Registered: June 1999
Senior Member
Hi guys,

I just opened an SR with Oracle for a strange situation.
By accident we created 2 FGA policies on one table. This table has an RLS security policy (not 100% sure if it is relevant, but still testing).
On performing a select with outer join to that table, we get an ORA-02014: cannot select FOR UPDATE from view with DISTINCT, GROUP BY, etc.
Note that this involves only base tables. No views, no in-line views, no nested tables, and no distinct/group by statements.
The outer join to this table is relevant, other joins are working as expected. There is no difference between an ansi-join and old-skool outer join.

The RLS policy adds a predicate referencing sys_context.

So far we can only reproduce on one table. We're still working on a reproducible test case. But I'm just wondering if somebody has encountered this before:

SQL> connect apps@ofac 
Verbonden. 
SQL> select * from v$version; 

BANNER 
-------------------------------------------------------------------------------- 
Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64bit Production 
PL/SQL Release 11.2.0.3.0 - Production 
CORE	11.2.0.3.0	Production 
TNS for 64-bit Windows: Version 11.2.0.3.0 - Production 
NLSRTL Version 11.2.0.3.0 - Production 

SQL> begin 
2 mo_global.init('PO'); 
3 end; 
4 / 

PL/SQL-procedure is geslaagd. 

SQL> SELECT 1 
2 FROM po_line_locations PLL, 
3 po_distributions POD 
4 WHERE PLL.po_header_id = 1542538 
5 AND PLL.line_location_id = POD.line_location_id (+) 
6 FOR UPDATE NOWAIT; 

1 
---------- 
1 
1 
1 
1 
1 

SQL> connect system@ofac 
Verbonden. 
SQL> begin 
2 dbms_fga.add_policy(object_schema=>'PO',object_name=>'PO_DISTRIBUTIONS_ALL',policy_name=>'PO_DISTRIBUTIONS_ALL1',statement_types=>'SELECT,INSERT,UPDATE,DELETE'); 
3 end; 
4 / 

PL/SQL-procedure is geslaagd. 

SQL> begin 
2 dbms_fga.add_policy(object_schema=>'PO',object_name=>'PO_DISTRIBUTIONS_ALL',policy_name=>'PO_DISTRIBUTIONS_ALL2',statement_types=>'INSERT,UPDATE,DELETE'); 
3 end; 
4 / 

PL/SQL-procedure is geslaagd. 

SQL> connect apps@ofac 
Verbonden. 
SQL> begin 
2 mo_global.init('PO'); 
3 end; 
4 / 

PL/SQL-procedure is geslaagd. 

SQL> SELECT 1 
2 FROM po_line_locations PLL, 
3 po_distributions POD 
4 WHERE PLL.po_header_id = 1542538 
5 AND PLL.line_location_id = POD.line_location_id (+) 
6 FOR UPDATE NOWAIT; 
po_distributions POD 
* 
FOUT in regel 3: 
.ORA-02014: Kan FOR UPDATE niet kiezen uit view met DISTINCT, GROUP BY, etc. 

SQL> connect system@ofac 
Verbonden. 
SQL> begin 
2 dbms_fga.drop_policy(object_schema=> 'PO',object_name=>'PO_DISTRIBUTIONS_ALL',policy_name=>'PO_DISTRIBUTIONS_ALL1'); 
3 end; 
4 / 

PL/SQL-procedure is geslaagd. 

SQL> connect apps@ofac 
Verbonden. 
SQL> 
SQL> begin 
2 mo_global.init('PO'); 
3 end; 
4 / 

PL/SQL-procedure is geslaagd. 

SQL> 
SQL> SELECT 1 
2 FROM po_line_locations PLL, 
3 po_distributions POD 
4 WHERE PLL.po_header_id = 1542538 
5 AND PLL.line_location_id = POD.line_location_id (+) 
6 FOR UPDATE NOWAIT; 

1 
---------- 
1 
1 
1 
1 
1 

SQL> spool off; 


We're aware of note: 452303.1. But this does not involve a nested table. We'll be testing the patch next week, anyway.

For us the issue is easily resolved by dropping the second FGA policy, but I'd like to know the root cause. So I'm testing with/without RLS, tables with different statistics/expected explain plans. But I can't find a reasonable explanation yet.

Does anybody have any thoughts for further testing or for the root cause of this?

Regards,

Arian

Previous Topic: Interesting explain plan output/puzzle
Next Topic: Default Value
Goto Forum:
  


Current Time: Sun Aug 09 04:49:38 CDT 2026