DB2 数据库特权授予的方法和技巧(6)
如果从 EMP 表进行选择，就会看到刚定义的新列。因为是用在 EXECUTIVE 级上定义的用户执行这一修改，添加的所有安全标记都是 EXECUTIVE。为了改变这一情况，需要更新这个表。
db2 => select EMPNO, FIRSTNME, LASTNAME, WORKDEPT, SALARY,
varchar(SECLABEL_TO_CHAR('J_DEPT_POLICY',DEPT_TAG),30) from gmilne.emp
EMPNO FIRSTNME LASTNAME WORKDEPT SALARY 6
------ ------------ --------------- -------- ----------- ------------------------------
000010 CHRISTINE HAAS A00 152750.00 HR_EXECUTIVE
000020 MICHAEL THOMPSON B01 94250.00 HR_EXECUTIVE
000030 SALLY KWAN C01 98250.00 HR_EXECUTIVE
000050 JOHN GEYER E01 80175.00 HR_EXECUTIVE
000060 IRVING STERN D11 72250.00 HR_EXECUTIVE
000070 EVA PULASKI D21 96170.00 HR_EXECUTIVE
000090 EILEEN HENDERSON E11 89750.00 HR_EXECUTIVE
000100 THEODORE SPENSER E21 86150.00 HR_EXECUTIVE
000110 VINCENZO LUCCHESSI A00 66500.00 HR_EXECUTIVE
000120 SEAN O'CONNELL A00 49250.00 HR_EXECUTIVE
000130 DELORES QUINTANA C01 73800.00 HR_EXECUTIVE
000140 HEATHER NICHOLLS C01 68420.00 HR_EXECUTIVE
000150 BRUCE ADAMSON D11 55280.00 HR_EXECUTIVE
000160 ELIZABETH PIANKA D11 62250.00 HR_EXECUTIVE
000170 MASATOSHI YOSHIMURA D11 44680.00 HR_EXECUTIVE
000180 MARILYN SCOUTTEN D11 51340.00 HR_EXECUTIVE
000190 JAMES WALKER D11 50450.00 HR_EXECUTIVE
000200 DAVID BROWN D11 57740.00 HR_EXECUTIVE
000210 WILLIAM JONES D11 68270.00 HR_EXECUTIVE
000220 JENNIFER LUTZ D11 49840.00 HR_EXECUTIVE
000230 JAMES JEFFERSON D21 42180.00 HR_EXECUTIVE
000240 SALVATORE MARINO D21 48760.00 HR_EXECUTIVE
000250 DANIEL SMITH D21 49180.00 HR_EXECUTIVE
000260 SYBIL JOHNSON D21 47250.00 HR_EXECUTIVE
000270 MARIA PEREZ D21 37380.00 HR_EXECUTIVE
000280 ETHEL SCHNEIDER E11 36250.00 HR_EXECUTIVE
000290 JOHN PARKER E11 35340.00 HR_EXECUTIVE
000300 PHILIP SMITH E11 37750.00 HR_EXECUTIVE
000310 MAUDE SETRIGHT E11 35900.00 HR_EXECUTIVE
000320 RAMLAL MEHTA E21 39950.00 HR_EXECUTIVE
000330 WING LEE E21 45370.00 HR_EXECUTIVE
000340 JASON GOUNOT E21 43840.00 HR_EXECUTIVE
200010 DIAN HEMMINGER A00 46500.00 HR_EXECUTIVE
200120 GREG ORLANDO A00 39250.00 HR_EXECUTIVE
200140 KIM NATZ C01 68420.00 HR_EXECUTIVE
200170 KIYOSHI YAMAMOTO D11 64680.00 HR_EXECUTIVE
200220 REBA JOHN D11 69840.00 HR_EXECUTIVE
200240 ROBERT MONTEVERDE D21 37760.00 HR_EXECUTIVE
200280 EILEEN SCHWARTZ E11 46250.00 HR_EXECUTIVE
200310 MICHELLE SPRINGER E11 35900.00 HR_EXECUTIVE
200330 HELENA WONG E21 35370.00 HR_EXECUTIVE
200340 ROY ALONZO E21 31840.00 HR_EXECUTIVE
42 record(s) selected.
update emp set DEPT_TAG=(SECLABEL_BY_NAME('J_DEPT_POLICY','A00')) where WORKDEPT='A00'
update emp set DEPT_TAG=(SECLABEL_BY_NAME('J_DEPT_POLICY','B01')) where WORKDEPT='B01'
update emp set DEPT_TAG=(SECLABEL_BY_NAME('J_DEPT_POLICY','C01')) where WORKDEPT='C01'
update emp set DEPT_TAG=(SECLABEL_BY_NAME('J_DEPT_POLICY','D11')) where WORKDEPT='D11'
update emp set DEPT_TAG=(SECLABEL_BY_NAME('J_DEPT_POLICY','D21')) where WORKDEPT='D21'
update emp set DEPT_TAG=(SECLABEL_BY_NAME('J_DEPT_POLICY','E01')) where WORKDEPT='E01'
update emp set DEPT_TAG=(SECLABEL_BY_NAME('J_DEPT_POLICY','E11')) where WORKDEPT='E11'
update emp set DEPT_TAG=(SECLABEL_BY_NAME('J_DEPT_POLICY','E21')) where WORKDEPT='E21'
db2 => select EMPNO, FIRSTNME, LASTNAME, WORKDEPT, SALARY,
varchar(SECLABEL_TO_CHAR('J_DEPT_POLICY',DEPT_TAG),30) from emp
EMPNO FIRSTNME LASTNAME WORKDEPT SALARY 6
------ ------------ --------------- -------- ----------- ------------------------------
000010 CHRISTINE HAAS A00 152750.00 A00
000020 MICHAEL THOMPSON B01 94250.00 B01
000030 SALLY KWAN C01 98250.00 C01
000050 JOHN GEYER E01 80175.00 E01
000060 IRVING STERN D11 72250.00 D11
000070 EVA PULASKI D21 96170.00 D21
000090 EILEEN HENDERSON E11 89750.00 E11
000100 THEODORE SPENSER E21 86150.00 E21
000110 VINCENZO LUCCHESSI A00 66500.00 A00
000120 SEAN O'CONNELL A00 49250.00 A00
000130 DELORES QUINTANA C01 73800.00 C01
000140 HEATHER NICHOLLS C01 68420.00 C01
000150 BRUCE ADAMSON D11 55280.00 D11
000160 ELIZABETH PIANKA D11 62250.00 D11
000170 MASATOSHI YOSHIMURA D11 44680.00 D11
000180 MARILYN SCOUTTEN D11 51340.00 D11
000190 JAMES WALKER D11 50450.00 D11
000200 DAVID BROWN D11 57740.00 D11
000210 WILLIAM JONES D11 68270.00 D11
000220 JENNIFER LUTZ D11 49840.00 D11
000230 JAMES JEFFERSON D21 42180.00 D21
000240 SALVATORE MARINO D21 48760.00 D21
000250 DANIEL SMITH D21 49180.00 D21
000260 SYBIL JOHNSON D21 47250.00 D21
000270 MARIA PEREZ D21 37380.00 D21
000280 ETHEL SCHNEIDER E11 36250.00 E11
000290 JOHN PARKER E11 35340.00 E11
000300 PHILIP SMITH E11 37750.00 E11
000310 MAUDE SETRIGHT E11 35900.00 E11
000320 RAMLAL MEHTA E21 39950.00 E21
000330 WING LEE E21 45370.00 E21
000340 JASON GOUNOT E21 43840.00 E21
200010 DIAN HEMMINGER A00 46500.00 A00
200120 GREG ORLANDO A00 39250.00 A00
200140 KIM NATZ C01 68420.00 C01
200170 KIYOSHI YAMAMOTO D11 64680.00 D11
200220 REBA JOHN D11 69840.00 D11
200240 ROBERT MONTEVERDE D21 37760.00 D21
200280 EILEEN SCHWARTZ E11 46250.00 E11
200310 MICHELLE SPRINGER E11 35900.00 E11
200330 HELENA WONG E21 35370.00 E21
200340 ROY ALONZO E21 31840.00 E21
42 record(s) selected.
在更新之后，我们来看看各个用户能够做什么。使用 Executive 用户 ID Jane 连接数据库。首先执行与前面一样的选择语句：
db2 => select EMPNO, FIRSTNME, LASTNAME, WORKDEPT, SALARY,
varchar(SECLABEL_TO_CHAR('J_DEPT_POLICY',DEPT_TAG),30) from gmilne.emp
EMPNO FIRSTNME LASTNAME WORKDEPT SALARY 6
------ ------------ --------------- -------- ----------- ------------------------------
000010 CHRISTINE HAAS A00 152750.00 A00
000020 MICHAEL THOMPSON B01 94250.00 B01
000030 SALLY KWAN C01 98250.00 C01
000050 JOHN GEYER E01 80175.00 E01
000060 IRVING STERN D11 72250.00 D11
000070 EVA PULASKI D21 96170.00 D21
000090 EILEEN HENDERSON E11 89750.00 E11
000100 THEODORE SPENSER E21 86150.00 E21
000110 VINCENZO LUCCHESSI A00 66500.00 A00
000120 SEAN O'CONNELL A00 49250.00 A00
000130 DELORES QUINTANA C01 73800.00 C01
000140 HEATHER NICHOLLS C01 68420.00 C01
000150 BRUCE ADAMSON D11 55280.00 D11
000160 ELIZABETH PIANKA D11 62250.00 D11
000170 MASATOSHI YOSHIMURA D11 44680.00 D11
000180 MARILYN SCOUTTEN D11 51340.00 D11
000190 JAMES WALKER D11 50450.00 D11
000200 DAVID BROWN D11 57740.00 D11
000210 WILLIAM JONES D11 68270.00 D11
000220 JENNIFER LUTZ D11 49840.00 D11
000230 JAMES JEFFERSON D21 42180.00 D21
000240 SALVATORE MARINO D21 48760.00 D21
000250 DANIEL SMITH D21 49180.00 D21
000260 SYBIL JOHNSON D21 47250.00 D21
000270 MARIA PEREZ D21 37380.00 D21
000280 ETHEL SCHNEIDER E11 36250.00 E11
000290 JOHN PARKER E11 35340.00 E11
000300 PHILIP SMITH E11 37750.00 E11
000310 MAUDE SETRIGHT E11 35900.00 E11
000320 RAMLAL MEHTA E21 39950.00 E21
000330 WING LEE E21 45370.00 E21
000340 JASON GOUNOT E21 43840.00 E21
200010 DIAN HEMMINGER A00 46500.00 A00
200120 GREG ORLANDO A00 39250.00 A00
200140 KIM NATZ C01 68420.00 C01
200170 KIYOSHI YAMAMOTO D11 64680.00 D11
200220 REBA JOHN D11 69840.00 D11
200240 ROBERT MONTEVERDE D21 37760.00 D21
200280 EILEEN SCHWARTZ E11 46250.00 E11
200310 MICHELLE SPRINGER E11 35900.00 E11
200330 HELENA WONG E21 35370.00 E21
200340 ROY ALONZO E21 31840.00 E21
42 record(s) selected.
以及更新命令：
db2 => update gmilne.emp set DEPT_TAG=(SECLABEL_BY_NAME('J_DEPT_POLICY','E01'))
where WORKDEPT='E01' DB20000I The SQL command completed successfully.
可以看到，Jane 对表中的所有数据有完全的访问权。现在，看看 Joe 可以看到的内容。首先进行选择。
db2 => select EMPNO, FIRSTNME, LASTNAME, WORKDEPT, SALARY,
varchar(SECLABEL_TO_CHAR('J_DEPT_POLICY',DEPT_TAG),30) from gmilne.emp
EMPNO FIRSTNME LASTNAME WORKDEPT SALARY 6
------ ------------ --------------- -------- ----------- ------------------------------
000060 IRVING STERN D11 72250.00 D11
000100 THEODORE SPENSER E21 86150.00 E21
000150 BRUCE ADAMSON D11 55280.00 D11
000160 ELIZABETH PIANKA D11 62250.00 D11
000170 MASATOSHI YOSHIMURA D11 44680.00 D11
000180 MARILYN SCOUTTEN D11 51340.00 D11
000190 JAMES WALKER D11 50450.00 D11
000200 DAVID BROWN D11 57740.00 D11
000210 WILLIAM JONES D11 68270.00 D11
000220 JENNIFER LUTZ D11 49840.00 D11
000320 RAMLAL MEHTA E21 39950.00 E21
000330 WING LEE E21 45370.00 E21
000340 JASON GOUNOT E21 43840.00 E21
200170 KIYOSHI YAMAMOTO D11 64680.00 D11
200220 REBA JOHN D11 69840.00 D11
200330 HELENA WONG E21 35370.00 E21
200340 ROY ALONZO E21 31840.00 E21
17 record(s) selected.
看到了吗?他只能看到 D11 和 E21 部门的信息。如果他试图选择不允许他访问的表数据，那么会发生什么：
db2 => select EMPNO, FIRSTNME, LASTNAME, WORKDEPT, SALARY,
varchar(SECLABEL_TO_CHAR('J_DEPT_POLICY',DEPT_TAG),30)
from gmilne.emp where empno='000130'
EMPNO FIRSTNME LASTNAME WORKDEPT SALARY 6
------ ------------ --------------- -------- ----------- ------------------------------
0 record(s) selected.
在前面 Jane 进行选择的结果中我们看到，有一个职员的 empno 是 000130，但是不允许 Joe 看到它。
现在是最后一个测试，对于用户 Frank 的测试。
首先，运行与前两个用户相同的选择：
db2 => select EMPNO, FIRSTNME, LASTNAME, WORKDEPT, SALARY,
varchar(SECLABEL_TO_CHAR('J_DEPT_POLICY',DEPT_TAG),30) from gmilne.emp
EMPNO FIRSTNME LASTNAME WORKDEPT SALARY 6
------ ------------ --------------- -------- ----------- ------------------------------
000010 CHRISTINE HAAS A00 152750.00 A00
000110 VINCENZO LUCCHESSI A00 66500.00 A00
000120 SEAN O'CONNELL A00 49250.00 A00
200010 DIAN HEMMINGER A00 46500.00 A00
200120 GREG ORLANDO A00 39250.00 A00
5 record(s) selected.
在这里可以看到，Frank 只能看到部门中他领导的用户的相关信息。我们来看看在他尝试进行更新时会发生什么：
db2 => update gmilne.emp set DEPT_TAG=(SECLABEL_BY_NAME('J_DEPT_POLICY','A00'))
where WORKDEPT='A00'DB21034E The command was processed as an SQL statement
because it was not a valid Command Line Processor command. During SQL processing it
returned:
SQL20402N Authorization ID "FRANK" does not have the LBAC credentials to
perform the "UPDATE" operation on table "EMPLOYEE". SQLSTATE=42519
尽管他尝试更新的记录是在自己的部门中，但是访问安全策略只允许他对表进行读访问。我们的业务需求已经得到了满足。