如何使用触发器实现级守护,防止DDL操作

如何使用触发器实现数据库级守护,防止DDL操作

--对于重要对象,实施DDL拒绝,防止create,drop,truncate,alter等重要操作

LastUpdated:Sunday,2004-10-3112:06Eygle

不管是有意还是无意的,你可能会遇到数据库中重要的数据表等对象被drop掉的情况,这可能会给我们带来巨大的损失.

通过触发器，我们可以实现对于表等对象的数据库级守护，禁止用户drop操作.

以下是一个简单的范例，供参考:

REMthisscriptcanbeusedtomonitoraobjectREMdenyanydropoperationonit.CREATEORREPLACETRIGGERtrg_dropdenyBEFOREDROPONDATABASEBEGINIFLOWER(ora_dict_obj_name())='test'THENraise_application_error(num=>-20000,msg=>'你疯了,想删除表'||ora_dict_obj_name()||'?!!!!!'||'你完了，警察已在途中.....');ENDIF;END;/

测试效果:

SQL>connectscott/tigerConnected.SQL>createtabletestasselect*fromdba_users;Tablecreated.SQL>connect/assysdbaConnected.SQL>createorreplacetriggertrg_dropdeny2beforedropondatabase3begin4iflower(ora_dict_obj_name())='test'5then6raise_application_error(7num=>-20000,8msg=>'你疯了,想删除表'||ora_dict_obj_name()||'?!!!!!'||'你完了，警察已在途中.....');9endif;10end;11/Triggercreated.SQL>connectscott/tigerConnected.SQL>droptabletest;droptabletest*ERRORatline1:ORA-00604:erroroccurredatrecursiveSQLlevel1ORA-20000:你疯了,想删除表TEST?!!!!!你完了，警察已在途中.....ORA-06512:atline4

从Oracle8i开始,允许实施DDL事件trigger，可是实现对于DDL的监视及控制,以下是一个进一步的例子:

createorreplacetriggerDDL_denybeforecreateoralterordroportruncateondatabasedeclarel_errmsgvarchar2(100):='Youhavenopermissiontothisoperation';beginifora_sysevent='CREATE'thenraise_application_error(-20001,ora_dict_obj_owner||'.'||ora_dict_obj_name||''||l_errmsg);elsifora_sysevent='ALTER'thenraise_application_error(-20001,ora_dict_obj_owner||'.'||ora_dict_obj_name||''||l_errmsg);elsifora_sysevent='DROP'thenraise_application_error(-20001,ora_dict_obj_owner||'.'||ora_dict_obj_name||''||l_errmsg);elsifora_sysevent='TRUNCATE'thenraise_application_error(-20001,ora_dict_obj_owner||'.'||ora_dict_obj_name||''||l_errmsg);endif;exceptionwhenno_data_foundthennull;end;/

我们看一下效果:

[oracle@jumpertools]$sqlplus"/assysdba"

SQL*Plus:Release9.2.0.4.0-ProductiononSunOct3111:38:252004

Copyright(c)1982,2002,OracleCorporation.Allrightsreserved.

Connectedto:
Oracle9iEnterpriseEditionRelease9.2.0.4.0-Production
WiththePartitioningoption
JServerRelease9.2.0.4.0-Production

SQL>setechoon
SQL>@DDLt
SQL>createorreplacetriggerDDL_deny
2beforecreateoralterordroportruncateondatabase
3declare
4l_errmsgvarchar2(100):='Youhavenopermissiontothisoperation';
5begin
6ifora_sysevent='CREATE'then
7raise_application_error(-20001,ora_dict_obj_owner||'.'||ora_dict_obj_name||''||l_errmsg);
8elsifora_sysevent='ALTER'then共2页 1