Add Oracle Label Security to an existing Oracle installation

Question

We are using Amazon EC2 to host some Oracle database instances while we are evaluating and prototyping some software. We are using the AMIs provided by Oracle - specifically, Oracle Database 11g Release 2 (11.2.0.1) Enterprise Edition - 64 Bit (Linux).

I now need to do some work based on Oracle Label Security - OLS. It appears that when Oracle was first installed into an AMI, the Oracle Label Security option was not enabled. So I want to add OLS to an existing installation of Oracle.

I have tried following the installation instructions in the Oracle Label Security Administrator's Guide, using media downloaded from following the download links on the Oracle home page. However the instructions don't match up with what I see when I run the installer - according to the instructions, on the second page of the wizard I should see an Advanced Installation option, but I don't see that - I can only see three radio buttons, "Create and configure a database", "Install database software only" and "Upgrade an existing database". I tried to muddle through the instructions but there were several inconsistencies, as if I was running a different version of the installer to the documentation writer. The AMI, documentation and media are all Oracle Database 11g Release 2 (11.2.0.1) so I don't know why they don't all seem to match.

I tried to proceed with an installation anyway, and did find the checkbox to install Oracle Label Security. However it would not accept my existing ORACLE_HOME as an installation destination, telling me: [INS-32025] The chosen installation conflicts with software already installed in the given Oracle home.

So, in short - is it possible for me to add the OLS option to an existing installation? If so - how? If not - how do I make a new installation and attach the existing database to the new installation?

Edit 2011年05月23日

After doing some more poking around, I found a copy of the Oracle installer at $ORACLE_HOME/oui/bin/runInstaller. This installer looks visually different and has different page flows. First thing it wanted to know was the source location, so I gave it the path to stage/products.xml on the installation media. It then gave me a choice of Enterprise, Standard or Custom - I selected Custom. It then asked for the Oracle home - this was pre-selected with the value of $ORACLE_HOME. So far so good.

Then, the first odd thing: it gave me a long list of installable products. Oracle Label Security was in this list, but it was already marked as "Installed". However if I clicked the Installed Products... button for information, Oracle Label Security was not present.

I selected Oracle Label Security anyway and it changed to say "reinstall". But on clicking Next I got this error: error message

• Jack Douglas: You mention the "media downloaded from following the download links on the Oracle home page" - is that this page? I think you should use the installer from the downloaded media, not from any other location.
• Richard Downer: @JackPDouglas Yes that's where I downloaded from. Just to confirm that everything before the Edit heading in the question was done using runInstaller downloaded from that location. Everything after the edit was with this different runInstaller that I discovered - but if that is going down the wrong track then I won't touch it again!
• Jack Douglas: Can you start again with a fresh AMI and post graphics of the first couple of steps of the installer?
• user3718: Do not use the OUI, you have to run the Database Configuration Assistant (dbca), which will give the "Configure Database Option" in Step 1 of 4. Step 3 of 4 provides a check box to instal Oracle Label Security.

Answer 1

Just guesswork, but do you select "Upgrade an existing database" early on:

upgrade

and "advanced install" later on:

enter image description here

The docs do look as if they are referring to the 10g installer.

• Richard Downer: First part is OK, I was able to select the Upgrade option. Then the following screen is Product Languages, then Database Edition, then Installation Location. Here I get stuck when trying to specify the same ORACLE_HOME. I don't see any advanced install option - in fact mine looks like a different page flow to your screen shots - any idea why I'm seeing something different?

Answer 2

Thanks for the information.

I was in the middle of a case where OLS wasn't installed. So, the procedure I used was as follows:

1. Shutdown all instances
2. On the main node, as user oracle, run $ORACLE_HOME/oui/bin/runInstaller (it could be necessary count on installation media)
3. Select "Advanced Options", select "OLS" (after that, option changes to "Reinstall"). Proceed. (On RAC, the process installs it on every node automatically.)
4. cd $ORACLE_HOME/bin; chopt enable lbac
5. Startup all instances
6. On the main node, run dbca connected as user oracle and choose "Configure options". OLS will be a selection available option.

7. Connected as sys or system, unlock and change password for user LBACSYS:

   ALTER USER lbacsys IDENTIFIED BY somepwd ACCOUNT UNLOCK;
   

Hope it helps.

Answer 3

I've got the same problem, and I've solved it as follows:

1. You need to rerun the installer and activate the option or use the Universal Installer to proceed

2. Unlock and give privileges to LBACSYS user:

   alter user LBACSYS 
   identified by LBACSYS account unlock;
   grant SELECT ANY DICTIONARY to LBACSYS;
   

3. Run the dbca and add the Oracle Label security to the instance

4. Shutdown the instance and run the chopt utility to enable the product (seems that by default is disabled):

   • set ORACLE_HOME,PATH environment variables
   • execute select * from v$option where parameter=’Oracle Label Security’; to validate if the option is disabled
   • run chopt enable lbac

5. Restart the instance and try again to create the policy