Oracle TDE加密測試

yingyifeng306發表於2021-06-17

文件說明

Oracle 資料庫使用身份驗證、授權和稽核機制來保護資料庫中的資料,但沒有能夠保護儲存在作業系統上的資料檔案。為了保護這些資料檔案, Oracle 資料庫提供透明資料加密( TDE )。該文件主要說明 oracle 高階安全元件中的透明資料加密 (TDE) 部分。

 

錢夾的部署

指定錢夾存放位置

在目錄 $ORACLE_HOME/network/admin 下找到檔案 sqlnet.ora ,新增如下內容:

# Oracle Advanced Security Transparent Data Encryption

ENCRYPTION_WALLET_LOCATION=

(SOURCE=(METHOD=FILE)(METHOD_DATA=

(DIRECTORY=/u01/app/oracle/product/11.2/network/admin/encryption_wallet)))

注意:如果是 RAC 環境, oracle 建議將錢夾位置放置在共享檔案系統上,以便各個節點共享訪問。

 

建立目錄

$cd /u01/app/oracle/product/11.2/network/admin/

$mkdir  encryption_wallet

 

建立主加密鍵

SQL> select * from v$encryption_wallet;

WRL_TYPE     WRL_PARAMETER                      STATUS

----------   ----------------------------   ------------------

file  /u01/app/oracle/product/11.2/network/admin/encryption_wallet

CLOSED

SQL> ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "test";

System altered.

SQL> select * from v$encryption_wallet;

WRL_TYPE     WRL_PARAMETER                      STATUS

----------   ----------------------------   ------------------

file  /u01/app/oracle/product/11.2/network/admin/encryption_wallet

OPEN

 

開啟和關閉錢夾

第一次設定萬能金鑰會自動開啟錢夾,每次資料庫被關閉,錢夾也關閉。在加密或解密之前必須確保錢夾被開啟。可以配置自動登入開啟(可選)。

SQL> ALTER SYSTEM SET ENCRYPTION WALLET OPEN IDENTIFIED BY "test";

(注: mount 狀態下就可以開啟錢夾)

關閉錢夾: ALTER SYSTEM SET ENCRYPTION WALLET CLOSE IDENTIFIED BY "test";

 

加密列和表空間具體過程

a. 加密表中一行測試

 

(1)    新建表透明加密

 

SQL> conn test/test;

Connected.

SQL> create table tde (id number(10),data varchar2(50) encrypt);

 

Table created.

 

SQL> insert into tde select user_id,username from dba_users;

 

10 rows created.

 

SQL> select * from tde;

 

        ID DATA

---------- --------------------------------------------------

        34 JSS

        35 TEST

         0 SYS

         5 SYSTEM

        31 APPQOSSYS

         9 OUTLN

        14 DIP

        30 DBSNMP

        32 WMSYS

        21 ORACLE_OCM

 

10 rows selected.

 

SQL> conn / as sysdba;

Connected.

SQL> select * from test.tde;

 

        ID DATA

---------- --------------------------------------------------

        34 JSS

        35 TEST

         0 SYS

         5 SYSTEM

        31 APPQOSSYS

         9 OUTLN

        14 DIP

        30 DBSNMP

        32 WMSYS

        21 ORACLE_OCM

 

10 rows selected.

 

SQL> select * from dba_encrypted_columns;

 

 

OWNER                          TABLE_NAME

------------------------------ ------------------------------

COLUMN_NAME                    ENCRYPTION_ALG                SAL INTEGRITY_AL

------------------------------ ----------------------------- --- ------------

TEST                           TDE

DATA                           AES 192 bits key              YES SHA-1

 

開啟錢夾才能查詢:

 

SQL> alter system set encryption wallet close identified by "hzmcdba";

 

System altered.

 

SQL> select * from test.tde;

select * from test.tde

*

ERROR at line 1:

ORA-28365: wallet is not open

 

 

SQL> alter system set encryption wallet open identified by "hzmcdba";

 

System altered.

 

SQL> select * from test.tde;

 

        ID DATA

---------- --------------------------------------------------

        34 JSS

        35 TEST

         0 SYS

         5 SYSTEM

        31 APPQOSSYS

         9 OUTLN

        14 DIP

        30 DBSNMP

        32 WMSYS

        21 ORACLE_OCM

 

10 rows selected.

 

(2)    已有表透明加密

 

SQL> conn test/test;

Connected.

SQL> create table existing_table(id number(10),data varchar2(50));

 

Table created.

 

SQL> insert into existing_table select user_id,username from dba_users;

 

10 rows created.

 

SQL> select * from existing_table;

 

        ID DATA

---------- --------------------------------------------------

        34 JSS

        35 TEST

         0 SYS

         5 SYSTEM

        31 APPQOSSYS

         9 OUTLN

        14 DIP

        30 DBSNMP

        32 WMSYS

        21 ORACLE_OCM

 

10 rows selected.

 

SQL> alter table existing_table modify(data encrypt);

 

Table altered.

 

b. 加密整體表空間

 

建立加密表空間

SQL> conn test/test;

Connected.

 

SQL> create tablespace encryptedtbs datafile '/oracle/app/orcl/secure01.dbf' size 5m encryption default storage(encrypt);

 

Tablespace created.

 

(1)    已有表移動至加密表空間

 

SQL> create table no_to_yes(id number(10),data varchar2(50));

 

Table created.

 

SQL> insert into no_to_yes select user_id,username from dba_users;

 

10 rows created.

 

SQL> alter system set encryption wallet close identified by "hzmcdba";

 

System altered.

 

SQL> select * from no_to_yes;

 

        ID DATA

---------- --------------------------------------------------

        34 JSS

        35 TEST

         0 SYS

         5 SYSTEM

        31 APPQOSSYS

         9 OUTLN

        14 DIP

        30 DBSNMP

        32 WMSYS

        21 ORACLE_OCM

 

10 rows selected.

SQL> alter table no_to_yes move tablespace encryptedtbs;

 

Table altered.

 

SQL> select table_name,tablespace_name from user_tables;

 

TABLE_NAME                     TABLESPACE_NAME

------------------------------ ------------------------------

TDE                            USERS

EXISTING_TABLE                 USERS

NO_TO_YES                      ENCRYPTEDTBS

 

SQL> alter system set encryption wallet close identified by "hzmcdba";

 

System altered.

 

SQL> select * from no_to_yes;

select * from no_to_yes

              *

ERROR at line 1:

ORA-28365: wallet is not open

 

(2)    在加密表空間中新建表測試

 

SQL> show user;

USER is "TEST"

SQL> create table encrypted_table (id number,name varchar(10)) tablespace encryptedtbs;

 

Table created.

 

SQL> insert into encrypted_table values (1,'hzmcdba');

 

1 row created.

 

SQL> select * from encrypted_table;

 

        ID NAME

---------- ----------

         1 hzmcdba

 

SQL> alter system set encryption wallet close identified by "hzmcdba";

 

System altered.

 

SQL> select * from encrypted_table;

select * from encrypted_table

              *

ERROR at line 1:

ORA-28365: wallet is not open

 

SQL> alter system set encryption wallet open identified by "hzmcdba";

 

System altered.

 

SQL> select * from encrypted_table;

 

        ID NAME

---------- ----------

         1 hzmcdba

 

RAC 中配置wallet 錢夾

路徑

 

Oracle 11gR2 RAC 節點能夠共享錢包。 Oracle 建議在共享檔案系統上建立錢包,這樣允許所有例項訪問相同的共享錢包,無需手動複製和同步所有節點上的錢包。

Oracle RAC 中一個例項對錢包進行操作(如開啟或關閉錢包),它會為 Oracle RAC 中所有例項開啟或關閉。

使用共享檔案系統時,需要確保所有 Oracle RAC 例項的 ENCRYPTION_WALLET_LOCATION WALLET_LOCATION 引數指向相同的共享錢包位置。安全管理員還需要透過分配相應的目錄許可權來確保共享錢包的安全性。

 

錢包的建立部署測試如下:

 

測試結果:指定錢夾存放目錄在共享磁碟中時,建立錢夾失敗!

指定錢夾存放目錄在本地時,錢夾可建立成功!

 

1.        指定錢包存放目錄在共享磁碟中

 

[oracle@rac1 admin]$ cat sqlnet.ora

ENCRYPTION_WALLET_LOCATION=

(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=+data/orcl/wallet)))

 

[oracle@rac1 admin]$ scp sqlnet.ora oracle@rac2:/oracle/app/product/11.2.0/db_1/network/admin/

sqlnet.ora                                          100%   94     0.1KB/s   00:00

 

SQL> select * from v$encryption_wallet;

 

WRL_TYPE

--------------------

WRL_PARAMETER

--------------------------------------------------------------------------------

STATUS

------------------

file

+data/orcl/wallet

CLOSED

 

 

SQL> alter system set encryption key identified by "test";

alter system set encryption key identified by "test"

*

ERROR at line 1:

ORA-28368: cannot auto-create wallet

 

說明:不能夠在 +data/orcl/wallet 目錄下建立檔案 ewallet.p12 往下看第 3 小點

 

2.       本地錢包配置及測試過程:

 

1 節點:

[oracle@rac1 admin]$ vi sqlnet.ora   

 

ENCRYPTION_WALLET_LOCATION=

(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=$ORACLE_HOME)))

 

[oracle@rac1 admin]$ scp sqlnet.ora oracle@rac2:/oracle/app/product/11.2.0/db_1/network/admin/

sqlnet.ora        

 

SQL> select * from v$encryption_wallet;

 

WRL_TYPE

--------------------

WRL_PARAMETER

--------------------------------------------------------------------------------

STATUS

------------------

file

$ORACLE_HOME

CLOSED

 

 

SQL> alter system set encryption key identified by "test";

 

System altered.

 

把錢夾複製到二節點:

 

[oracle@rac1 db_1]$ scp ewallet.p12 oracle@rac2:/oracle/app/product/11.2.0/db_1/

ewallet.p12                                         100% 2845     2.8KB/s   00:00

 

2 節點查詢:

SQL> select * from v$encryption_wallet;

 

WRL_TYPE

--------------------

WRL_PARAMETER

--------------------------------------------------------------------------------

STATUS

------------------

file

$ORACLE_HOME

OPEN

 

1 節點建個加密表:

SQL> create user test identified by "test";

 

User created.

 

SQL> grant dba to test;

 

Grant succeeded.

 

SQL> conn test/test;

Connected.

 

SQL> create table tde (id number(10),data varchar2(50) encrypt);

 

Table created.

 

SQL> insert into tde select user_id,username from dba_users;

 

10 rows created.

 

SQL> select * from tde;

 

        ID DATA

---------- --------------------------------------------------

         0 SYS

         5 SYSTEM

        34 ORACLE

        35 TEST

         9 OUTLN

        31 APPQOSSYS

        30 DBSNMP

        32 WMSYS

        14 DIP

        21 ORACLE_OCM

 

10 rows selected.

 

SQL> commit;

 

Commit complete.

 

2 節點進行查詢:

 

SQL> conn test/test;

Connected.

 

SQL> select * from tde;

 

        ID DATA

---------- --------------------------------------------------

         0 SYS

         5 SYSTEM

        34 ORACLE

        35 TEST

         9 OUTLN

        31 APPQOSSYS

        30 DBSNMP

        32 WMSYS

        14 DIP

        21 ORACLE_OCM

 

10 rows selected.

 

(資料可以查到!)

錢夾部署成功!

 

1 節點

SQL> alter system set encryption wallet close identified by "test";

 

System altered.

 

SQL> select * from tde;

select * from tde

              *

ERROR at line 1:

ORA-28365: wallet is not open

 

2 節點查詢:

 

SQL> select * from tde;

select * from tde

*

ERROR at line 1:

ORA-28365: wallet is not open

 

2 節點開啟錢包:

 

SQL> alter system set encryption wallet open identified by "test";

 

System altered.

 

SQL> select * from tde;

 

        ID DATA

---------- --------------------------------------------------

         0 SYS

         5 SYSTEM

        34 ORACLE

        35 TEST

         9 OUTLN

        31 APPQOSSYS

        30 DBSNMP

        32 WMSYS

        14 DIP

        21 ORACLE_OCM

 

10 rows selected.

 

1 節點查詢:

 

SQL> select * from tde;

 

        ID DATA

---------- --------------------------------------------------

         0 SYS

         5 SYSTEM

        34 ORACLE

        35 TEST

         9 OUTLN

        31 APPQOSSYS

        30 DBSNMP

        32 WMSYS

        14 DIP

        21 ORACLE_OCM

 

10 rows selected.

 

3.       1 小點中,我們指定錢夾位置在共享磁碟上,然後建立錢夾,建立錢夾失敗,在這直接把錢夾複製到共享磁碟上,看能否成功!

 

把錢包複製到共享磁碟上:

 

ASMCMD> cp /oracle/app/product/11.2.0/db_1/ewallet.p12.bak +data/orcl/wallet/ewallet.p12.bak

ASMCMD-8012: cannot determine file type for file

ORA-15056: additional error message

ORA-27046: file size is not a multiple of logical block size

Additional information: 1

ORA-06512: at "SYS.X$DBMS_DISKGROUP", line 322

ORA-06512: at line 3 (DBD ERROR: OCIStmtExecute)

 

複製失敗,從這也說明了前面直接指定共享磁碟路徑建立錢夾失敗的原因,共享磁碟上不支援此類檔案。

 

 

端配置 錢夾

指定錢夾存放位置

備庫:

在目錄 $ORACLE_HOME/network/admin 下找到檔案 sqlnet.ora ,新增如下內容:

# Oracle Advanced Security Transparent Data Encryption

ENCRYPTION_WALLET_LOCATION=

(SOURCE=(METHOD=FILE)(METHOD_DATA=

(DIRECTORY=/u01/app/oracle/product/11.2/network/admin/encryption_wallet)))

 

建立目錄

備庫:

$cd /u01/app/oracle/product/11.2/network/admin/

$mkdir  encryption_wallet

 

複製primary 端加密錢夾

將生產端錢夾目錄下的 ewallet.p12 複製到 standby 端指定的錢夾目錄下。對於 DG 來說這樣的設定還不夠,因為錢夾在這個時候還沒有被開啟,歸檔仍舊無法正常應用。我們對於備端建議使用無人值守的自動開啟的錢包。

 

建立自動開啟的錢夾

備庫:

自動開啟錢夾(檔名是 cwallet.sso )在資料庫啟動時會自動開啟。

兩種方法可建立自動開啟的錢夾

-- 命令列工具“ orapki

 

$ cd $ORACLE_HOME/network/admin/ encryption_wallet

$ orapki wallet create –wallet $ORACLE_HOME/network/admin/encryption_wallet -auto_login_local

提示輸入 primary 設定的錢夾密碼

 

錢夾存放目錄下會生成一個新檔案 cwallet.sso

 

-- 圖形化方式顯示

oracle 使用者執行 owm ,開啟錢夾管理工具:

 

選擇“開啟錢夾”,找到存放錢夾的路徑:

輸入正確的密碼,開啟錢夾:

 

在選單欄選中 錢夾 ,勾上 "Auto Login" 的核取方塊,表示自動登入開啟;

 

配置完成後儲存退出

 

錢夾存放目錄下會生成一個新檔案 cwallet.sso

 

此時 DG 端開啟應用程式即可正常應用日誌。

alter database recover managed standby database disconnect from session;

 

說明

DG 主庫部署 wallet ,備庫不部署 wallet

 

檢視 alert 日誌發現,歸檔能夠正常傳輸到備庫,但是查詢應用情況就發現,歸檔並不能被應用在備庫中:

SQL> SELECT SEQUENCE#, APPLIED,FIRST_TIME, NEXT_TIME FROM V$ARCHIVED_LOG ORDER BY SEQUENCE#;

 

 SEQUENCE# APPLIED   FIRST_TIM NEXT_TIME

---------- --------- --------- ---------

        88 YES       12-MAY-17 12-MAY-17

        89 YES       12-MAY-17 12-MAY-17

        90 YES       12-MAY-17 13-MAY-17

        91 YES       13-MAY-17 13-MAY-17

        92 YES       13-MAY-17 13-MAY-17

        93 YES       13-MAY-17 13-MAY-17

        94 YES       13-MAY-17 13-MAY-17

        95 YES       13-MAY-17 13-MAY-17

        96 YES       13-MAY-17 13-MAY-17

        97 YES       13-MAY-17 13-MAY-17

        98 YES       13-MAY-17 13-MAY-17

 

 SEQUENCE# APPLIED   FIRST_TIM NEXT_TIME

---------- --------- --------- ---------

        99 YES       13-MAY-17 13-MAY-17

       100 YES       13-MAY-17 13-MAY-17

       101 YES       13-MAY-17 13-MAY-17

       102 YES       13-MAY-17 13-MAY-17

       103 YES       13-MAY-17 13-MAY-17

       104 YES       13-MAY-17 13-MAY-17

       105 YES       13-MAY-17 13-MAY-17

       106 YES       13-MAY-17 13-MAY-17

       107 YES       13-MAY-17 13-MAY-17

       108 YES       13-MAY-17 13-MAY-17

       109 NO        13-MAY-17 13-MAY-17

 

 SEQUENCE# APPLIED   FIRST_TIM NEXT_TIME

---------- --------- --------- ---------

       110 NO        13-MAY-17 13-MAY-17

       111 NO        13-MAY-17 13-MAY-17

       112 NO        13-MAY-17 13-MAY-17

       113 NO        13-MAY-17 13-MAY-17

       114 NO        13-MAY-17 13-MAY-17

       115 NO        13-MAY-17 13-MAY-17

       116 NO        13-MAY-17 13-MAY-17

       117 NO        13-MAY-17 13-MAY-17

       118 NO        13-MAY-17 13-MAY-17

       119 NO        13-MAY-17 13-MAY-17

       120 NO        13-MAY-17 13-MAY-17

 

 SEQUENCE# APPLIED   FIRST_TIM NEXT_TIME

---------- --------- --------- ---------

       121 NO        13-MAY-17 13-MAY-17

       122 NO        13-MAY-17 13-MAY-17

 

alert 日誌報錯:

Media Recovery Log /arch/1_109_936453293.dbf

Apply redo for TSE master key re-key failed: wallet error 28365

Standby Crash Recovery aborted due to error 28365.

Errors in file /oracle/app/diag/rdbms/orcl/orcl/trace/orcl_ora_3517.trc:

ORA-28365: wallet is not open

Recovery interrupted!

Recovered data files to a consistent state at change 1238216

Completed Standby Crash Recovery.

 

備庫開啟 wallet (從主庫複製而來)是否可以正常應用日誌

 

測試如下:

 

主庫 SCP 到備庫:

[oracle@localhost wallet]$ scp ewallet.p12  192.168.40.71:/oracle/app/admin/orcl/wallet

oracle@192.168.40.71's password:

ewallet.p12                                            100% 2845     2.8KB/s   00:00

 

備庫開啟 wallet 錢包:

SQL> ALTER SYSTEM SET ENCRYPTION WALLET OPEN IDENTIFIED BY wallet;

System altered.

 

手動應用 mrp 日誌:

alter database recover managed standby database disconnect from session;

 

檢視 alert 日誌發現成功應用:

Waiting for all non-current ORLs to be archived...

All non-current ORLs have been archived.

Media Recovery Log /arch/1_123_936453293.dbf

Media Recovery Log /arch/1_124_936453293.dbf

Media Recovery Log /arch/1_125_936453293.dbf

Completed: alter database recover managed standby database disconnect from session

Media Recovery Log /arch/1_126_936453293.dbf

Media Recovery Log /arch/1_127_936453293.dbf

Media Recovery Log /arch/1_128_936453293.dbf

Media Recovery Log /arch/1_129_936453293.dbf

Media Recovery Log /arch/1_130_936453293.dbf

Media Recovery Log /arch/1_131_936453293.dbf

Media Recovery Log /arch/1_132_936453293.dbf

Media Recovery Log /arch/1_133_936453293.dbf

Media Recovery Log /arch/1_134_936453293.dbf

Media Recovery Log /arch/1_135_936453293.dbf

Media Recovery Log /arch/1_136_936453293.dbf

Media Recovery Log /arch/1_137_936453293.dbf

 

關閉 mrp 程式並將資料庫啟動到 read only 模式後查詢資料:

SQL> alter database recover managed standby database cancel;

 

Database altered.

 

SQL> alter database open read only;

SQL> select * from test.employee;

 

NAME                   ID

-------------------------------------------------------------------------------test                    456

 

test2                   789

 

test3                    123

 

SQL> select table_name,column_name from DBA_ENCRYPTED_COLUMNS;

 

TABLE_NAME                     COLUMN_NAME

------------------------------ ------------------------------

EMPLOYEE                       ID

 

Dg 切換測試:

 

備庫:(自動開啟錢夾)

[oracle@ljw orcl]$ orapki wallet create -wallet /oracle/app/wallet/orcl -auto_login_local

Oracle PKI Tool : Version 11.2.0.4.0 - Production

Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved.

 

Enter wallet password:         

 

SQL> select * from v$encryption_wallet;

 

WRL_TYPE

--------------------

WRL_PARAMETER

--------------------------------------------------------------------------------

STATUS

------------------

file

/oracle/app/wallet/$ORACLE_SID

OPEN

 

主庫:(手動開啟錢夾)

SQL> select * from v$encryption_wallet;

 

WRL_TYPE

--------------------

WRL_PARAMETER

--------------------------------------------------------------------------------

STATUS

------------------

file

/oracle/app/wallet/$ORACLE_SID

OPEN

 

主備切換:

 

主庫:

SQL> alter system switch logfile;

 

System altered.

 

SQL> select max(sequence#) from v$archived_log;

 

MAX(SEQUENCE#)

--------------

           453

 

備庫查詢:

SQL> select max(sequence#) from v$archived_log;

 

MAX(SEQUENCE#)

--------------

           453

 

主庫:

SQL> select switchover_status from v$database;

 

SWITCHOVER_STATUS

--------------------

TO STANDBY

 

SQL> Alter database commit to switchover to physical standby with session shutdown;

 

Database altered.

 

SQL> startup nomount

ORACLE instance started.

 

Total System Global Area  784998400 bytes

Fixed Size                  2257352 bytes

Variable Size             432016952 bytes

Database Buffers          348127232 bytes

Redo Buffers                2596864 bytes

SQL> alter database mount standby database;

 

Database altered.

 

SQL> ALTER DATABASE RECOVER MANAGED STANDBY DATABASE DISCONNECT FROM SESSION;

 

Database altered.

 

備庫:

 

SQL> select switchover_status from v$database;

 

SWITCHOVER_STATUS

--------------------

TO PRIMARY

 

SQL> ALTER DATABASE COMMIT TO SWITCHOVER TO PRIMARY;

 

Database altered.

 

SQL> shutdown immediate

ORA-01109: database not open

 

 

Database dismounted.

ORACLE instance shut down.

SQL> startup

ORACLE instance started.

 

Total System Global Area  784998400 bytes

Fixed Size                  2257352 bytes

Variable Size             432016952 bytes

Database Buffers          348127232 bytes

Redo Buffers                2596864 bytes

Database mounted.

Database opened.

 

切日誌查詢:

 

主庫:

SQL> alter system switch logfile;

 

System altered.

 

SQL> select max(sequence#) from v$archived_log;

 

MAX(SEQUENCE#)

--------------

           455

 

備庫:

SQL> select max(sequence#) from v$archived_log;

 

MAX(SEQUENCE#)

--------------

           455

 

主庫查詢加密表:

 

SQL> select * from v$encryption_wallet;

 

WRL_TYPE

--------------------

WRL_PARAMETER

--------------------------------------------------------------------------------

STATUS

------------------

file

/oracle/app/wallet/$ORACLE_SID

OPEN

 

SQL> conn test/test;

Connected.

SQL> select * from tde;

 

        ID DATA

---------- --------------------------------------------------

        34 JSS

        35 TEST

         0 SYS

         5 SYSTEM

        31 APPQOSSYS

         9 OUTLN

        14 DIP

        30 DBSNMP

        32 WMSYS

        21 ORACLE_OCM

 

10 rows selected.

 

備庫(原來為主庫):

 

SQL> select * from v$encryption_wallet;

 

WRL_TYPE

--------------------

WRL_PARAMETER

--------------------------------------------------------------------------------

STATUS

------------------

file

/oracle/app/wallet/$ORACLE_SID

CLOSED

(注:原來的主庫沒有建立自動錢包,所以切成備庫以後,需要手動開啟)


來自 “ ITPUB部落格 ” ,連結:http://blog.itpub.net/23732248/viewspace-2777115/,如需轉載,請註明出處,否則將追究法律責任。

相關文章