ORA-47958与Oracle Database Vault

今天开发人员在测试环境做exp时报错
ORA-47958: Running EXP with direct path option is disallowed when Oracle Database Vault is enabled.
$ oerr ora 47958
47958, 00000, "Running EXP with direct path option is disallowed when Oracle Database Vault is enabled."
// *Cause: While Oracle Database Vault was enabled, an attempt was made to run
//         EXP with the 'direct=y' option.
// *Action: Change the option to 'direct=n' or disable Oracle Database Vault and retry the operation.

Oracle Database Vault是官方推荐的security策略之一，它从数据对象、操作命令等多个方面来限制或者保护特定的对象。因为Oracle Database Vault与直接路径读取导出冲突，所以需要禁用Oracle Database Vault。
$ sqlplus / as sysdba

SQL*Plus: Release 11.2.0.4.0 Production on Tue Dec 30 18:09:04 2014

Copyright (c) 1982, 2013, Oracle.  All rights reserved.

Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, Oracle Label Security, OLAP, Data Mining,
Oracle Database Vault and Real Application Testing options

SQL> SELECT * FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault';

PARAMETER                      VALUE
------------------------------ ----------
Oracle Database Vault          TRUE

SQL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> exit
Disconnected from Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, Oracle Label Security, OLAP, Data Mining,
Oracle Database Vault and Real Application Testing options
$ emctl stop dbconsole
$ lsnrctl stop
$ cd $ORACLE_HOME/rdbms/lib
$ make -f ins_rdbms.mk dv_off ioracle
/usr/bin/ar d /u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/libknlopt.a kzvidv.o
/usr/bin/ar cr /u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/libknlopt.a /u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/kzvndv.o
chmod 755 /u01/app/oracle/product/11.2.0.4/dbhome_1/bin

 - Linking Oracle
rm -f /u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/oracle
gcc  -o /u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/oracle -m64 -z noexecstack -L/u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/ -L/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/ -L/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/stubs/   -Wl,-E /u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/opimai.o /u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/ssoraed.o /u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/ttcsoi.o  -Wl,--whole-archive -lperfsrv11 -Wl,--no-whole-archive /u01/app/oracle/product/11.2.0.4/dbhome_1/lib/nautab.o /u01/app/oracle/product/11.2.0.4/dbhome_1/lib/naeet.o /u01/app/oracle/product/11.2.0.4/dbhome_1/lib/naect.o /u01/app/oracle/product/11.2.0.4/dbhome_1/lib/naedhs.o /u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/config.o  -lserver11 -lodm11 -lcell11 -lnnet11 -lskgxp11 -lsnls11 -lnls11  -lcore11 -lsnls11 -lnls11 -lcore11 -lsnls11 -lnls11 -lxml11 -lcore11 -lunls11 -lsnls11 -lnls11 -lcore11 -lnls11 -lclient11  -lvsn11 -lcommon11 -lgeneric11 -lknlopt `if /usr/bin/ar tv /u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/libknlopt.a | grep xsyeolap.o > /dev/null 2>&1 ; then echo "-loraolap11" ; fi` -lslax11 -lpls11  -lrt -lplp11 -lserver11 -lclient11  -lvsn11 -lcommon11 -lgeneric11 `if [ -f /u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libavserver11.a ] ; then echo "-lavserver11" ; else echo "-lavstub11"; fi` `if [ -f /u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libavclient11.a ] ; then echo "-lavclient11" ; fi` -lknlopt -lslax11 -lpls11  -lrt -lplp11 -ljavavm11 -lserver11  -lwwg  `cat /u01/app/oracle/product/11.2.0.4/dbhome_1/lib/ldflags`    -lncrypt11 -lnsgr11 -lnzjs11 -ln11 -lnl11 -lnro11 `cat /u01/app/oracle/product/11.2.0.4/dbhome_1/lib/ldflags`    -lncrypt11 -lnsgr11 -lnzjs11 -ln11 -lnl11 -lnnz11 -lzt11 -lmm -lsnls11 -lnls11  -lcore11 -lsnls11 -lnls11 -lcore11 -lsnls11 -lnls11 -lxml11 -lcore11 -lunls11 -lsnls11 -lnls11 -lcore11 -lnls11 -lztkg11 `cat /u01/app/oracle/product/11.2.0.4/dbhome_1/lib/ldflags`    -lncrypt11 -lnsgr11 -lnzjs11 -ln11 -lnl11 -lnro11 `cat /u01/app/oracle/product/11.2.0.4/dbhome_1/lib/ldflags`    -lncrypt11 -lnsgr11 -lnzjs11 -ln11 -lnl11 -lnnz11 -lzt11   -lsnls11 -lnls11  -lcore11 -lsnls11 -lnls11 -lcore11 -lsnls11 -lnls11 -lxml11 -lcore11 -lunls11 -lsnls11 -lnls11 -lcore11 -lnls11 `if /usr/bin/ar tv /u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/libknlopt.a | grep "kxmnsd.o" > /dev/null 2>&1 ; then echo " " ; else echo "-lordsdo11"; fi` -L/u01/app/oracle/product/11.2.0.4/dbhome_1/ctx/lib/ -lctxc11 -lctx11 -lzx11 -lgx11 -lctx11 -lzx11 -lgx11 -lordimt11 -lclsra11 -ldbcfg11 -lhasgen11 -lskgxn2 -lnnz11 -lzt11 -lxml11 -locr11 -locrb11 -locrutl11 -lhasgen11 -lskgxn2 -lnnz11 -lzt11 -lxml11  -loraz -llzopro -lorabz2 -lipp_z -lipp_bz2 -lippdcemerged -lippsemerged -lippdcmerged  -lippsmerged -lippcore  -lippcpemerged -lippcpmerged  -lsnls11 -lnls11  -lcore11 -lsnls11 -lnls11 -lcore11 -lsnls11 -lnls11 -lxml11 -lcore11 -lunls11 -lsnls11 -lnls11 -lcore11 -lnls11 -lsnls11 -lunls11  -lsnls11 -lnls11  -lcore11 -lsnls11 -lnls11 -lcore11 -lsnls11 -lnls11 -lxml11 -lcore11 -lunls11 -lsnls11 -lnls11 -lcore11 -lnls11 -lasmclnt11 -lcommon11 -lcore11 -laio    `cat /u01/app/oracle/product/11.2.0.4/dbhome_1/lib/sysliblist` -Wl,-rpath,/u01/app/oracle/product/11.2.0.4/dbhome_1/lib -lm    `cat /u01/app/oracle/product/11.2.0.4/dbhome_1/lib/sysliblist` -ldl -lm   -L/u01/app/oracle/product/11.2.0.4/dbhome_1/lib
test ! -f /u01/app/oracle/product/11.2.0.4/dbhome_1/bin/oracle ||\
           mv -f /u01/app/oracle/product/11.2.0.4/dbhome_1/bin/oracle /u01/app/oracle/product/11.2.0.4/dbhome_1/bin/oracleO
mv /u01/app/oracle/product/11.2.0.4/dbhome_1/rdbms/lib/oracle /u01/app/oracle/product/11.2.0.4/dbhome_1/bin/oracle
chmod 6751 /u01/app/oracle/product/11.2.0.4/dbhome_1/bin/oracle
$ sqlplus / as sysdba

SQL*Plus: Release 11.2.0.4.0 Production on Tue Dec 30 18:12:13 2014

Copyright (c) 1982, 2013, Oracle.  All rights reserved.

Connected to an idle instance.

SQL> startup
ORACLE instance started.

Total System Global Area 8785408000 bytes
Fixed Size                  2260368 bytes
Variable Size            1644167792 bytes
Database Buffers         7113539584 bytes
Redo Buffers               25440256 bytes
Database mounted.
Database opened.
SQL> SELECT * FROM V$OPTION WHERE PARAMETER = 'Oracle Database Vault';

PARAMETER                      VALUE
------------------------------ ----------
Oracle Database Vault          FALSE

之后，开发人员可以正常导出。

如果需要开启Oracle Database Vault，也需要shutdown重新编译。
make -f ins_rdbms.mk dv_on lbac_on ioracle

附：关闭/启用Oracle Database Vault
1、关闭实例
2、修改Oracle Database Vault
   cd $ORACLE_HOME/rdbms/lib
   关闭Oracle Database Vault
   make -f ins_rdbms.mk dv_off ioracle
   开启Oracle Database Vault
   make -f ins_rdbms.mk dv_on lbac_on ioracle
3、启动实例