Oracle | XS_ACL

Oracle XS_ACL_INT Version 26ai

General Information

Library Note

Morgan's Library Page Header

The best Oracle News for FY2026

Oracle Database 26ai will be available on generic Linux platforms in January and soon on AIX and Windows

Purpose Real Application Security Internal Utilities

AUTHID DEFINER

Dependencies

DBMS_STANDARD	XS$ACE_LIST	XS$OBJ
DBMS_SYS_ERROR	XS$ACE_PRIV	XS$POLICY_PARAM
DUAL	XS$ACE_TYPE	XS$PRIN
PLITBLM	XS$ACL	XS_ACL
USER$	XS$ACL_PARAM	XS_ADMIN_INT
X$KSPPCV	XS$INSTSET_ACL	XS_ADMIN_UTIL
X$KSPPI	XS$NAME_LIST	XS_MTCACHE_INT
XS$ACE	XS$NSTMPL

Documented No

First Available Not known

Security Model Owned by SYS with no privileges granted

Source {ORACLE_HOME}/rdbms/admin/prvtacl.plb

Subprograms

ADD_ACL_PARAMETER	GRANT_PRIVILEGE	SET_DESCRIPTION
APPEND_ACES	REMOVE_ACES	SET_PARENT_ACL
CREATE_ACL	REMOVE_ACL_PARAMETERS	SET_SECURITY_CLASS
DELETE_ACL	REVOKE_PRIVILEGE

ADD_ACL_PARAMETER

Add a numeric parameter value

Overload 1 xs_acl_int.add_acl_parameter(acl IN VARCHAR2 acl IN VARCHAR2, policy IN VARCHAR2, parameter IN VARCHAR2, value IN NUMBER);

TBD

Add a string parameter value

Overload 2 xs_acl_int.add_acl_parameter(acl IN VARCHAR2 acl IN VARCHAR2, policy IN VARCHAR2, parameter IN VARCHAR2, value IN VARCHAR2);

exec xs_acl_int.add_acl_parameter('DBSECWORXACL','XPOLICY','GEO', 'EMEA');

APPEND_ACES

Append one ACE to the ACL

Overload 1 xs_acl_int.append_aces( acl IN VARCHAR2, ace IN sys.xs$ace_type);

DECLARE

       atype xs$ace_type;

      BEGIN 

       
      atype := xs$ace_type(privilege_list=>xs$name_list('"SELECT"'),

                             granted=>TRUE,

                             principal_name=>'DBA',

                             principal_type=>xs_acl.ptype_db);

       
      xs_acl_int.append_aces('DBSECWORXACL', atype);

      END;

      /

Overload 2 xs_acl_int.append_aces( acl IN VARCHAR2, ace_list IN sys.xs$ace_list);

TBD

CREATE_ACL

Create an Access Control List xs_acl_int.create_acl( name IN VARCHAR2, ace_list IN sys.xs#ace_list, sec_class IN VARCHAR2, parent IN VARCHAR2, inherit_mode IN BINARY_INTEGER, description IN VARCHAR2);

col acl format a45

      col owner format a20

      col privilege format a20

      col security_class format a20

      

      SELECT acl, owner, privilege, security_class

      FROM dba_xs_aces

      ORDER BY 1;

      

      DECLARE

       alist xs$ace_list;

      BEGIN 

        alist := xs$ace_list(

                   xs$ace_type(privilege_list=>xs$name_list('"SELECT"','VIEW_SENSITIVE_INFO'),

                               granted=>TRUE,

                               principal_name=>'CSR'),

                   xs$ace_type(privilege_list=>xs$name_list('UPDATE_INFO'),

                               granted=>TRUE,

                               principal_name=>'MGR'));

        xs_acl_int.create_acl('DBSECWORXACL', alist, 'SECPRIVS', description=>'Data Access');

      END;

      /

      

      SELECT acl, owner, privilege, security_class

      FROM dba_xs_aces

      WHERE acl = 'DBSECWORXACL';

      

      ACL           OWNER  PRIVILEGE            SECURITY_CLASS

      ------------- ------ -------------------- ---------------

      DBSECWORXACL  SYS    SELECT               SECPRIVS

      DBSECWORXACL  SYS    VIEW_SENSITIVE_INFO  SECPRIVS

      DBSECWORXACL  SYS    UPDATE_INFO          SECPRIVS

DELETE_ACL

Drop an Access Control list xs_acl_int.delete_acl( acl IN VARCHAR2, delete_option IN BINARY_INTEGER);

exec xs_acl_int.delete_acl('DBSECWORXACL');

GRANT_PRIVILEGE

Undocumented xs_acl_int.grant_privilege( acl IN VARCHAR2, privilege IN VARCHAR2, principal IN VARCHAR2, principal_type IN BINARY_INTEGER);

TBD

REMOVE_ACES

Not sure if this removes an ACE or an ACL. Name and parameter do not agree xs_acl_int.remove_aces(acl IN VARCHAR2);

exec xs_acl_int.remove_aces('DBSECWORXACL');

REMOVE_ACL_PARAMETERS

Undocumented

Overload 1 xs_acl_int.remove_acl_parameters(acl IN VARCHAR2);

exec xs_acl_int.remove_acl_parameters('DBSECWORXACL');

Overload 2 xs_acl_int.remove_acl_parameters( acl IN VARCHAR2, parameter IN VARCHAR2);

exec xs_acl_int.remove_acl_parameters('DBSECWORXACL', 'XPOLICY', 'GEO');

Overload 3 xs_acl_int.remove_acl_parameters( acl IN VARCHAR2, policy IN VARCHAR2, parameter IN VARCHAR2);

exec xs_acl_int.remove_acl_parameters('DBSECWORXACL', 'XPOLICY', 'GEO');

REVOKE_PRIVILEGE

Undocumented xs_acl_int.revoke_privilege( acl IN VARCHAR2, privilege IN VARCHAR2, principal IN VARCHAR2, principal_type IN BINARY_INTEGER);

TBD

SET_DESCRIPTION

Sets or updates the description of an ACL in the data dictionary xs_acl_int.set_description( acl IN VARCHAR2, description IN VARCHAR2);

exec xs_acl_int.set_description('DBSECWORXACL', 'DBSecWorx Secure ACL');

SET_PARENT_ACL

Sets the parent ACL xs_acl_int.set_parent_acl( acl IN VARCHAR2, parent IN VARCHAR2, inherit_mode IN BINARY_INTEGER);

exec xs_acl_int.set_parent_acl('DSECWORX','SYSTEMACL', xs_acl_int.extended);

SET_SECURITY_CLASS

Sets the security class xs_acl_int.set_security_class( acl IN VARCHAR2, sec_class IN VARCHAR2);

col acl format a45

      col owner format a20

      col privilege format a20

      col security_class format a20

      

      SELECT acl, owner, privilege, security_class

      FROM dba_xs_aces

      WHERE acl = 'DBSECWORXACL';

      

      ACL           OWNER  PRIVILEGE            SECURITY_CLASS

      ------------- ------ -------------------- ---------------

      DBSECWORXACL  SYS    SELECT               SECPRIVS

      DBSECWORXACL  SYS    VIEW_SENSITIVE_INFO  SECPRIVS

      DBSECWORXACL  SYS    UPDATE_INFO          SECPRIVS

      

      exec xs_acl_int.set_security_class('DBSECWORXACL', 'SYSTEM');

      

      SELECT acl, owner, privilege, security_class

      FROM dba_xs_aces

      WHERE acl = 'DBSECWORXACL';

      

      ACL           OWNER  PRIVILEGE            SECURITY_CLASS

      ------------- ------ -------------------- ---------------

      DBSECWORXACL  SYS    SELECT               SYSTEM

      DBSECWORXACL  SYS    VIEW_SENSITIVE_INFO  SYSTEM

      DBSECWORXACL  SYS    UPDATE_INFO          SYSTEM