Figuring out DB2 LBAC policies for any user - db2

Question

IBM DB2 has nice LBAC (label based access control) policy. I am not facing problem when creating or using these policies from within the query browser. However, my requirement is a bit different. Using LBAC, let us say that I have created the required security labels and assigned them to the columns and rows in the database tables. Now, Given the access control for the user, I want to find out if a particular label is accessible to that user.
DB2 will internally figure it out and produce the desired results, however I need some solution which would tell me if a particular column/row is accessible to the user, if I am given the user's access level along with the security labels for each column/row. I need some method which does the following:
Find out the security labels for a column [I can do this]
Find out the access controls allowed to the user [I can do this]
Tell if these security labels are accessible for the user [I do not know how to achieve this]
Consider this example:
My sample component:
/*Create the component*/
CREATE SECURITY LABEL COMPONENT ORG_DIVISIONS
TREE ('ORGANIZATION_ADMIN' ROOT, --The admin will have the complete access
'SALES' UNDER 'ORGANIZATION_ADMIN', --The sales department will have acess to the financial information for each unit
'RESEARCH' UNDER 'ORGANIZATION_ADMIN', --The research division will have access to technical specs and design along with certain financial information
'RSM1' UNDER 'RESEARCH', --The research manager 1 will have access to certain design and technical specs and certain financial information (depending on the project he is undertaking)
'RS_ENGG1' UNDER 'RSM1', --The research engineer 1 will have access to certain technical specs (depending on the project he is undertaking)
'MANUFACTURING' UNDER 'ORGANIZATION_ADMIN', --The manufacturing unit will have access to design along with certain financial information
'MFM1' UNDER 'MANUFACTURING', --The manufacturing division manager 1 will have access to certain designs along with certain financial information (depending on the project he is undertaking)
'MF_ENGG1' UNDER 'MFM1' --The manufacturing division engineer 1 will have access to certain designs (depending on the project he is undertaking)
)
My sample policy for the component:
/*Create the policy*/
CREATE SECURITY POLICY ORGANIZATION_POLICY
COMPONENTS ORG_DIVISIONS
WITH DB2LBACRULES
RESTRICT NOT AUTHORIZED WRITE SECURITY LABEL
My sample set of labels:
/*Create the labels from the policy components*/
CREATE SECURITY LABEL ORGANIZATION_POLICY.ORGANIZATION_ADMIN
COMPONENT ORG_DIVISIONS 'ORGANIZATION_ADMIN'
CREATE SECURITY LABEL ORGANIZATION_POLICY.SALES
COMPONENT ORG_DIVISIONS 'SALES';
CREATE SECURITY LABEL ORGANIZATION_POLICY.RESEARCH
COMPONENT ORG_DIVISIONS 'RESEARCH';
CREATE SECURITY LABEL ORGANIZATION_POLICY.RSM1
COMPONENT ORG_DIVISIONS 'RSM1';
CREATE SECURITY LABEL ORGANIZATION_POLICY.RS_ENGG1
COMPONENT ORG_DIVISIONS 'RS_ENGG1';
CREATE SECURITY LABEL ORGANIZATION_POLICY.MFM1
COMPONENT ORG_DIVISIONS 'MFM1';
CREATE SECURITY LABEL ORGANIZATION_POLICY.MF_ENGG1
COMPONENT ORG_DIVISIONS 'MF_ENGG1';
My sample user:
/*Use the defined policies and grant accesses to the users*/
GRANT SECURITY LABEL ORGANIZATION_POLICY.RSM1
TO USER someone FOR ALL ACCESS;
Now, since I defined a tree component, the user someone will have access to entities which are labeled RSM1 or with its children labels (RS_ENGG1 in this case). DB2 knows this and will present me the relevant results if login as user someone and fire queries. But the question is, how can I (as an admin) know which columns/rows would be accessible to user someone? Can this information be retrieved from some security table or figured out somehow?
Regards,
Salil Joshi

Answer 1

I could not find any solution to this problem. What I ultimately did was to find out the security components of the type 'Tree' and 'Array', list their components, and re-constructing the equivalent tree in Java.
1) Find out the labels granted to the user
SELECT
A.grantee
,B.secpolicyname
,c.seclabelname
FROM
syscat.securitylabelaccess A
,syscat.securitypolicies B
,syscat.securitylabels C
WHERE
A.seclabelid = C.seclabelid
AND A.secpolicyid = B.secpolicyid
AND B.secpolicyid = C.secpolicyid
2) Find out the array and tree component elements:
For trees:
SELECT
D.secpolicyname
,B.elementvalue
,B.parentelementvalue
FROM
syscat.securitylabelcomponents A
,syscat.securitylabelcomponentelements B
,syscat.securitypolicycomponentrules C
,syscat.securitypolicies D
WHERE
A.compid = B.compid
AND A.comptype = 'T'
AND A.compid = C.secpolicyid
AND C.secpolicyid = D.secpolicyid
For arrays (note: I could not find the order in which the elements were inserted in the array, but found that doing a selection (select *) rather than projection (select A.a, B.b, ...) helps here. Any better solutions are welcome):
SELECT *
FROM
syscat.securitylabelcomponents A
,syscat.securitylabelcomponentelements B
,syscat.securitypolicycomponentrules C
,syscat.securitypolicies D
WHERE
A.compid = B.compid
AND A.comptype = 'A'
AND A.compid = C.compid
AND C.secpolicyid = D.secpolicyid
3) Generate the list of labels allowed for the user using the above constructs.
One small problem here is that the component elements and the labels created from them might not have same name, and I could not find any mapping for them. I have posted this problem here for the same.