DB2 10.5 for Linux, UNIX, and Windows

ALTER SECURITY LABEL COMPONENT statement

The ALTER SECURITY LABEL COMPONENT statement modifies a security label component.

Invocation

This statement can be embedded in an application program or issued interactively. It is an executable statement that can be dynamically prepared only if DYNAMICRULES run behavior is in effect for the package (SQLSTATE 42509).

Authorization

The privileges held by the authorization ID of the statement must include SECADM authority.

Syntax


>>-ALTER SECURITY LABEL COMPONENT--component-name--| add-element-clause |-><

add-element-clause

|--ADD ELEMENT--string-constant--+--------------------------+---|
                                 +-| array-element-clause |-+   
                                 '-| tree-element-clause |--'   

array-element-clause

|--+-BEFORE-+--string-constant----------------------------------|
   '-AFTER--'                    

tree-element-clause

|--+-ROOT--------------------------------------------------+----|
   '-UNDER--string-constant--+---------------------------+-'   
                             | .-,---------------------. |     
                             | V                       | |     
                             '---OVER--string-constant-+-'

Description

component-name

Specifies the name of the security label component to be altered. The named component must exist at the current server (SQLSTATE 42704).

ADD ELEMENT

Specifies the element to be added to the security label component. If array-element-clause and tree-element-clause are not specified, the element is added to a set component.

string-constant: The string constant value to be added to the set of valid values for the security label component. The value cannot be the same as any other value in the set of valid values for the security label component (SQLSTATE 42713).

BEFORE or AFTER

For an array component, specifies where the element is to be added in the ordered set of element values for the security label component.

BEFORE: The element to be added is to be ranked immediately before the identified existing element.
AFTER: The element to be added is to be ranked immediately after the identified existing element.
string-constant: Specifies a string constant value of an existing element in the array component (SQLSTATE 42704).

ROOT or UNDER

For a tree component, specifies where the element is to be added in the tree structure of node element values for the security label component.

ROOT

The element to be added is to be considered the root node of the tree.

UNDER string-constant

The element to be added is an immediate child of the element identified by the string-constant. The string-constant value must be an existing element in the tree component (SQLSTATE 42704).

OVER string-constant,...: The element to be added is an immediate child of every element identified by the list of string-constant values. Each string-constant value must be an existing element in the tree component (SQLSTATE 42704).

Rules

Element names cannot contain any of these characters (SQLSTATE 42601):
- Opening parenthesis - (
- Closing parenthesis - )
- Comma - ,
- Colon - :
An element name can have no more than 32 bytes (SQLSTATE 42622).
If a security label component is a set or a tree, no more than 64 elements can be part of that component.
If the component is an array, it might or might not be possible to arrive at an array whose total number of elements matches the total number of elements that could be specified when creating a security label component of type array (65 535). The database manager assigns an encoded value to the new element from within the interval into which the new element is added. Depending on the pattern followed when adding elements to an array component, the number of possible values that can be assigned from within a particular interval might be quickly exhausted if several elements are inserted into that interval.
BEFORE and AFTER must only be specified for a security label component that is an array (SQLSTATE 42613).
ROOT and UNDER must only be specified for a security label component that is a tree (SQLSTATE 42613).

Notes

For a set component, there is no order to the elements in the set.

Examples

Example 1: Add the element 'High classified' to the LEVEL security label array component between the elements 'Secret' and 'Classified'.
```
   ALTER SECURITY LABEL COMPONENT LEVEL
     ADD ELEMENT 'High classified' BEFORE 'Classified'
```
Example 2: Add the element 'Funding' to the COMPARTMENTS security label set component.
```
   ALTER SECURITY LABEL COMPONENT COMPARTMENTS
     ADD ELEMENT 'Funding'
```

Example 3: Add the elements 'ENGINE' and 'TOOLS' to the GROUPS security label array component. The following diagram shows where these new elements are to be placed.

                       PROJECT
                  ________|________
                 |                 |
              ENGINE             TOOLS
         ________|________
        |                 |
      TEST           DEVELOPMENT
                    ______|______
                   |             |
                CURRENT        FIELD


   ALTER SECURITY LABEL COMPONENT GROUPS
     ADD ELEMENT 'TOOLS' UNDER 'PROJECT'

   ALTER SECURITY LABEL COMPONENT GROUPS
     ADD ELEMENT 'ENGINE' UNDER 'PROJECT'
       OVER 'TEST', 'DEVELOPMENT'