- Posted by Gavin Soorma
- On April 20, 2017
- 0 Comments
- 12.2, 12c Release 2, lockdown profiles, multitenant, new features, pluggable database, security
In an earlier post I had mentioned one of the new features in Oracle Database 12.2 was the ability to set SGA and PGA memory related parameters even at the individual PDB level. So it enables us to further limit or define the resources which a particular PDB can use and enable a more efficient management of resources in a multitenant environment.
We can further in Oracle 12c Release 2 now even limit the operations which can be performed within a particular PDB as well as restrict features which can be used or enabled – all at the individual PDB level. We can also limit network connectivity a PDB can have by enabling or disabling the use of network related packages like UTL_SMTP,UTL_HTTP, UTL_TCP at the PDB level.
This is done via the new 12.2 feature called Lockdown Profiles.
We create lockdown profiles via the CREATE LOCKDOWN PROFILE statement while connected to the root CDB and after the lockdown profile has been created, we add the required restrictions or limits which we would like to enforce via the ALTER LOCKDOWN PROFILE statement.
To assign the lockdown profile to a particular PDB, we use the
PDB_LOCKDOWN initialization parameter which will contain the name of the lockdown profile we have earlier created.
If we set the PDB_LOCKDOWN parameter at the CDB level, it will apply to all the PDB’s in the CDB. We can also set the PDB_LOCKDOWN parameter at the PDB level and we can maybe have different PDB_LOCKDOWN values for different PDB’s as we will see in the example below.
Let us have a look at an example of PDB Lockdown Profiles at work.
In our CDB, we have two pluggable databases PDB1 and PDB2. We want to limit some kind of operations depending on the PDB involved.
Our requirements are the following:
- We want to ensure that in PDB1 the value for SGA_TARGET cannot be altered – so even a privileged user cannot allocate additional memory to the PDB. However if memory is available, then PGA allocation can be altered.
- To shutdown PDB1, it can only be done if connected to the root container and not from within the Pluggable Database itself
- The Partitioning feature is not available in PDB2