Database Vault Realm does NOT protect against SYS execution of expdp with Transportable Table Space (with option transport_tablespaces='XYZ' )
Test case:
+++++++
dbca -silent -configureDatabase -sourceDB <DBname> -addDBOption DV -dvUserName dvowner1 -dvUserPassword <PASSWORD> -dvAccountManagerName dvacctmgr1 -dvAccountManagerPassword <PASSWORD>
CREATE TABLESPACE tbs1 DATAFILE '<PATH>/tbs01.dbf' SIZE 40M ONLINE;
conn dvacctmgr1
create user xxxx identified by "<PASSWORD>" default tablespace tbs1;
conn / as sysdba
grant connect, resource to xxxx
conn xxxx/xxxxx
create table table1 ( v1 varchar2(10));
insert into xxxx.table1 values ('a');
insert into xxxx.table1 values ('b');
insert into xxxx.table1 values ('c');
commit;
conn dvowner1
BEGIN
DBMS_MACADM.CREATE_REALM(
realm_name => 'Testing Realm',
description => 'Realm to test TTS',
enabled => DBMS_MACUTL.G_YES,
audit_options => DBMS_MACUTL.G_REALM_AUDIT_FAIL);
END;
/
BEGIN
DBMS_MACADM.ADD_OBJECT_TO_REALM(
realm_name => 'Testing Realm',
object_owner => 'xxxx',
object_name => '%',
object_type => '%');
END;
/
conn / as sysdba
alter tablespace tbs1 read only;
=================
expdp \'/ as sysdba\' directory=DV_ADMIN_DIR dumpfile=data.dmp transport_tablespaces='TBS1' TRANSPORT_FULL_CHECK=Y
Export: Release 11.2.0.4.0 - Production on Wed Dec 2 04:08:01 20**
Copyright (c) 1982, 2011, Oracle and/or its affiliates. All rights reserved.
Connected to: Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, Oracle Label Security, OLAP, Data Mining,
Oracle Database Vault and Real Application Testing options
Starting "SYS"."SYS_EXPORT_TRANSPORTABLE_01": "/******** AS SYSDBA" directory=DV_ADMIN_DIR dumpfile=data.dmp transport_tablespaces=TBS1 TRANSPORT_FULL_CHECK=Y
Processing object type TRANSPORTABLE_EXPORT/PLUGTS_BLK
Processing object type TRANSPORTABLE_EXPORT/TABLE
Processing object type TRANSPORTABLE_EXPORT/POST_INSTANCE/PLUGTS_BLK
...............................
Job "SYS"."SYS_EXPORT_TRANSPORTABLE_01" successfully completed
CHANGES
CAUSE
Internal Bug 14456083 - NEED DATABASE VAULT DP PROTECTION FOR TRANSPORTABLE TABLESPACE
SOLUTION
Apply one-off patch 14456083
Issue has been fixed in 12.1 and further.