DB2 10.5 for Linux, UNIX, and Windows

LBAC-protected data export considerations

When you export data that is protected by label-based access control (LBAC), the data that is exported is limited to the data that your LBAC credentials allow you to read.

If your LBAC credentials do not allow you to read a row, that row is not exported, but no error is returned. If your LBAC credentials do not allow you to read a column, the export utility fails, and an error (SQLSTATE 42512) is returned.

A value from a column with a data type of DB2SECURITYLABEL is exported as raw data enclosed in character delimiters. If a character delimiter is included in the original data, it is doubled. No other changes are made to the bytes that make up the exported value. This means that a data file that contains DB2SECURITYLABEL data can contain newlines, formfeeds, or other non-printable ASCII characters.

If you want the values of columns with a data type of DB2SECURITYLABEL to be exported in a human-readable form, you can use the SECLABEL_TO_CHAR scalar function in the SELECT statement to convert the values to the security label string format.

Examples

In the following examples, output is in DEL format and is written to the file myfile.del. The data is exported from a table named REPS, which was created with the following statement:

create table reps (row_label db2securitylabel,
id integer,
name char(30))
security policy data_access_policy

This example exports the values of the row_label column in the default format:

db2 export to myfile.del of del select * from reps

The data file is not very readable in most text editors because the values for the row_label column are likely to contain several ASCII control characters.

The following example exports the values of the row_label column in the security label string format:

db2 export to myfile.del of del select SECLABEL_TO_CHAR
(row_label,'DATA_ACCESS_POLICY'), id, name from reps

Here is an excerpt of the data file created by the previous example. Notice that the format of the security label is readable:

...
"Secret:():Epsilon 37",	2005,	"Susan Liu"
"Secret:():(Epsilon 37,Megaphone,Cloverleaf)",	2006,	"Johnny Cogent"
"Secret:():(Megaphone,Cloverleaf)",	2007,	"Ron Imron"
...