B
Command-line Tools for Label Security Using Oracle Internet Directory

olsadmintool alterpolicy --name defense --options 'READ_CONTROL,
INSERT_CONTROL'
 -h yippee -D cn=defense_admin -w welcome1

Cancel Audit Options

olsadmintool noaudit --poln
ame <policy name> --options <audit option name>
[ -b <admin context> ] -h <OID host> [-p <port>] -D <
;bind DN> -w <bind password>

Descrip tion of noaudit command

Use the noaudit command to cancel the audit options for a po licy. Provide the policy name and the options that are no longer to be audited. ^{Command Footnote< /sup>}

Example of the noaudit command

olsadmintool noaudit --polname defense --options 'APPLY,PRIVILEGES'
-h yi
ppee -D cn=defense_admin -w welcome1

Create a Compartment

olsadmintool createcompartment --polname <poli
cy name> --tag <tag number> 
--shortname <short compartment name> --longname <long compartment name>
[ -b <ad
min context> ] -h <OID host> [-p <port>] -D <bind DN> -w <bind password>

Description of the createcompartment command

Use the createcompartment command to create a new compartment component. Provide the name of the policy, the tag nume ric value of the compartment, the short name of the compartment, and the long name of the compartment. ^{Command Footnote}

Example of the crea tecompartment command

olsadmintool createcompartment --polname
 defense --tag 100 --shortname A 
--longname Alpha -h yippee -D cn=defense_admin -w welcome1

Create a Group

olsadmintool creategroup --polname <policy name> --tag <tag number> --shortname 
<short group name> --longname <
;long group name>
[--parentname <parent group name>]
[ -b <admin context> ] -h <OID host> [-p <port>] -D &
lt;bind DN> -w <bind password>

Descr iption of the creategroup command

Use the creategroup command to create a new group component. Provide the name of the policy, the tag numeric value of the group, the short name of the group, the long name of the grou p, and the parent group name (optional). ^{Command Footnote}

Example of the creategroup command

<
/a>
olsadmintool creategroup --polname defense --tag 55 --shortname US
--longname 'United States' -h yippee -D c
n=defense_admin -w welcome1

Create a Label

olsadmintool createlabel --polname <policy name> --tag <
;tag number> --value 
<label value>
[ -b <admin context> ] -h <OID host> [-p <port>] -D <bind DN> -w
 <bind password>

Description of the cre atelabel command

Use the createlabel command to create a valid data label. Provide t he policy name, the numeric tag of the label to be created, and the character string representation of the label.^{Command Footnote}

Example o f the createlabel command

olsadmintool createlabel --polname d
efense --tag 100 --value 'TS:A,B:US,CA'
-h yippee -D cn=defense_admin -w welcome1

Create a Level

olsadminto
ol createlevel --polname <policy name> --tag <tag number> --shortname 
<short level name> --longname <long level
 name>
[ -b <admin context> ] -h <OID host> [-p <port>] -D <bind DN> -w <bind password>

Description of the createlevel command

Use the createlevel command to create a new level component. Provide the name of the policy, the tag n umeric value, the short name of the level, and the long name of the level. ^{Command Footnote}

Example of the createlevel command

olsadmintool createlevel --polname defense --tag 100 --shortname TS
--long
name 'TOP SECRET' -h yippee -D cn=defense_admin -w welcome1

Create a Profile

olsadmintool createprofile --p
olname <policy name> --profname <profile name> 
--maxreadlabel <max read label> --maxwritelabel <max write label
> 
--minwritelabel <min write label> --defreadlabel <default read label> 
--defrowlabel <default row label> --pr
ivileges <privileges separated by comma>
[ -b <admin context> ] -h <OID host> [-p <port>] -D <bind DN>
-w <bind password>

Description of the c reateprofile command

Use the createprofile command to create a new profile. Provide the policy name, the profile name, and either privileges, labels, or both privileges and labels. (A user profil e can have either null label information or null privilege information, but not both null at the same time.) For labels, specify the maximum label users in this profile can use to read data, the maximum label users in this profile can use to write data, the minimum label users in this profile can use to write data, the default label for reading, the default row label for writing. For privileges, enclose in quotes the list of privileges, separated by commas, for members of this profile. ^{Command F ootnote}

Example of the createprofile c ommand

olsadmintool createprofile --polname topsecret --profna
me topsales 
--maxreadlabel 'TS:A,B:US,CA' --maxwritelabel 'TS:A,B:US,CA' --minwritelabel 
'C:A,B:US,CA' --defreadlabel 'TS:A,B:US,CA
' --defrowlabel 'C:A,B:US,CA'
--privileges 'READ,COMPACCESS,WRITEACROSS'
-b EDS -h ford -p 1890 -D cn=lbacsys -w lbacsyspwrd

Create Policy

olsadmintool createpolicy --name <policy name> --colname <column name> --options 
<opt
ions separated by commas>
[ -b <admin context> ] -h <OID host> [-p <port>] -D <bind DN> -w <bind passwo
rd>

Description of the createpolicy comman d

Use the createpolicy command to create a policy. Provide the name of the policy, t he name of its label column, and the options. ^{Command Footnote}

olsadmintool createpolicy --name defense --colname defense_col --options 'READ_
CONTROL,UPDATE_CONTROL
' -h yippee -p 389 -D cn=defense_admin -w welcome1

Describe a Profile

olsadmintool describeprofile --polnam
e <policy name> --profname <profile name>
[ -b <admin context> ] -h <OID host> [-p <port>] -D <bind
DN> -w <bind password>

Description o f the describeprofile command

Us e the describeprofile command to see the contents of the specified profile in the specified policy. Provide the policy name and the n ame of the profile. ^{Command Footnote}

Example of the describeprofile command

olsadmintool describeprofile --polname defense --profname contractors
-h yippee -D cn=defense_a
dmin -w welcome1

Drop a Compartment

olsadmintool dropcompartment --polname <policy name> --shortname
<short 
compartment name>
[ -b <admin context> ] -h <OID host> [-p <port>] -D <bind DN> -w <bind pas
sword>

Description of the dr opcompartment command

Use the dropcompartment command to remove a co mpartment component. Provide the name of the policy and the short name of the compartment. ^{Command Fo otnote}

Example of the dr opcompartment command

olsadmintool dropcompart
ment --polname defense --shortname A
-h yippee -D cn=defense_admin -w welcome1

olsadmintool dr
opgroup --polname <policy name> --shortname <short group name>
[ -b <admin context> ] -h <OID host> [-p <p
ort>] -D <bind DN> -w <bind password>

olsadmintool dropgroup --
polname defense --shortname US
-h yippee -D cn=defense_admin -w welcome1

olsadmintool droplabe
l --polname <policy name> --value <label value>
-h yippee [-p <port>] -D <bind DN> -w <bind password>
<
/pre>


Description of the droplabel command

 
Use the droplabel command to drop a label from the policy. Prov
ide the policy name and the string representation of the label. Command Footnote
 
Example of the droplabel com
mand

olsadmintool droplabel --polname defense --value 'TS:A:US
'
h yippee -D cn=defense_admin -w welcome1




Drop a Level
olsadmintool droplevel --polname <policy name>
; --shortname <short level name>
[ -b <admin context> ] -h <OID host> [-p <port>] -D <bind DN> -w <b
ind password>



Description of the <
code>droplevel command
 
Use the droplevel command to remove a level c
omponent from a specified policy. Provide the name of the policy and the short name of the level. Com
mand Footnote
 
Example of the <
code>droplevel command

olsadmintool droplevel
--polname defense --shortname TS
-h yippee -D cn=defense_admin -w welcome1




Drop a Policy
olsadmintool dropp
olicy --name <policy name>
[ -b <admin context> ] -h <OID host> [-p <port>] -D <bind DN> -w <bind pa
ssword>



Description of the d
roppolicy command
 
Use the droppolicy command to drop a policy. Provi
de the name of the policy to be dropped.Command Footnote For directory-enabled installation
s of Oracle Label Security, see also Subscribing Policies in Directory-Enabled Label Security in <
a href="admpolcy.htm#1011245">Chapter 9, "Applying Policies to Tables and Schemas".
 
Example of the droppolicy command

olsadmintool droppolicy --name defense -h yippee -D cn=defense_admin -w welcome1




Drop a Profile
<
pre class="CE">olsadmintool dropprofile --polname <policy name> --profname <profile name>
[ -b <a
dmin context> ] -h <OID host> [-p <port>] -D <bind DN> -w <bind password>

olsadmintool dropprofile --name defense --profname employees
-h yippee -D cn=defense_admin -w welcome1

olsadmintool dropuser --polname <policy name> --profname <profilename>
--userdn <enterprise user DN&g
t;
[ -b <admin context> ] -h <OID host> [-p <port>] -D <bind DN> -w <bind password>

olsadmintool dropuser --polname defense --prof
name contractors --userdn 
'cn=hanssen,c=us' -h yippee -D cn=defense_admin -w welcome1

olsadmintool dropadmin --polname <policy name> --admindn <admin DN>
[ -b <admin context> ] -h <OID host>
; [-p <port>] -D <bind DN> -w <bind password>