有关用户角色和权限的管理配置问题

在实际的生产用户过程中，角色的应用很广泛，那么到底什么是角色呢？

角色是一组权限的集合，可以授权给用户或角色，用于控制用户对对象的访问和行为。

创建用户的时候,你是否为了贪图方便直接授权DBA角色给它呢？其实这是种非常有风险的行为。

下面你可以思考两个问题：

1. connect,resource角色包含哪些权限?

2. 如何查询用户具有哪些角色?

connect,resource角色包含哪些权限?

可以通过DBA_SYS_PRIVES视图来查询



可见，我们将connect,resource角色授于用户就能满足一般用户的需要了。

因此，我们也可以很方便地根据PRIVILEGE字段来查询某些具体的权限，再根据对应角色授权给用户，做好权限控制。

++++++++

SQL> select * from dba_sys_privs where GRANTEE = 'DBA';

GRANTEE PRIVILEGE ADM

------------------------------ ---------------------------------------- ---

DBA CHANGE NOTIFICATION YES

DBA ADMINISTER ANY SQL TUNING SET YES

DBA ALTER ANY SQL PROFILE YES

DBA CREATE RULE YES

DBA EXPORT FULL DATABASE YES

DBA EXECUTE ANY EVALUATION CONTEXT YES

DBA DEQUEUE ANY QUEUE YES

DBA DROP ANY INDEXTYPE YES

DBA ALTER ANY INDEXTYPE YES

DBA EXECUTE ANY LIBRARY YES

DBA CREATE ANY LIBRARY YES

DBA CREATE ANY DIRECTORY YES

DBA ALTER PROFILE YES

DBA EXECUTE ANY PROCEDURE YES

DBA CREATE ROLE YES

DBA SELECT ANY SEQUENCE YES

DBA DROP ANY INDEX YES

DBA UPDATE ANY TABLE YES

DBA INSERT ANY TABLE YES

DBA SELECT ANY TABLE YES

DBA DROP ROLLBACK SEGMENT YES

DBA BECOME USER YES

DBA DROP TABLESPACE YES

DBA ALTER SESSION YES

DBA CREATE SESSION YES

DBA ANALYZE ANY DICTIONARY YES

DBA ALTER ANY RULE SET YES

DBA CREATE RULE SET YES

DBA DEBUG ANY PROCEDURE YES

DBA CREATE DIMENSION YES

DBA ALTER ANY LIBRARY YES

DBA UNDER ANY TYPE YES

DBA DROP ANY MATERIALIZED VIEW YES

DBA DROP ANY TRIGGER YES

DBA ALTER ANY PROCEDURE YES

DBA FORCE ANY TRANSACTION YES

DBA ALTER DATABASE YES

DBA DELETE ANY TABLE YES

DBA ALTER ROLLBACK SEGMENT YES

DBA EXECUTE ANY PROGRAM YES

DBA EXECUTE ANY RULE YES

DBA IMPORT FULL DATABASE YES

DBA EXECUTE ANY RULE SET YES

DBA CREATE ANY RULE SET YES

DBA FLASHBACK ANY TABLE YES

DBA RESUMABLE YES

DBA ADMINISTER DATABASE TRIGGER YES

DBA CREATE ANY OUTLINE YES

DBA ALTER ANY DIMENSION YES

DBA CREATE ANY DIMENSION YES

DBA EXECUTE ANY OPERATOR YES

DBA CREATE TYPE YES

DBA CREATE TRIGGER YES

DBA GRANT ANY ROLE YES

DBA DROP ANY VIEW YES

DBA CREATE VIEW YES

DBA LOCK ANY TABLE YES

DBA ALTER USER YES

DBA CREATE USER YES

DBA ALTER TABLESPACE YES

DBA CREATE TABLESPACE YES

DBA RESTRICTED SESSION YES

DBA CREATE ANY JOB YES

DBA CREATE JOB YES

DBA CREATE ANY RULE YES

DBA DROP ANY EVALUATION CONTEXT YES

DBA CREATE ANY EVALUATION CONTEXT YES

DBA CREATE EVALUATION CONTEXT YES

DBA GRANT ANY OBJECT PRIVILEGE YES

DBA SELECT ANY DICTIONARY YES

DBA DROP ANY DIMENSION YES

DBA UNDER ANY TABLE YES

DBA CREATE INDEXTYPE YES

DBA CREATE ANY OPERATOR YES

DBA DROP ANY LIBRARY YES

DBA ANALYZE ANY YES

DBA ALTER ANY ROLE YES

DBA CREATE ANY SEQUENCE YES

DBA CREATE ANY INDEX YES

DBA CREATE ANY TABLE YES

DBA MANAGE FILE GROUP YES

DBA MANAGE SCHEDULER YES

DBA ADMINISTER RESOURCE MANAGER YES

DBA ALTER ANY OUTLINE YES

DBA DROP ANY CONTEXT YES

DBA EXECUTE ANY INDEXTYPE YES

DBA UNDER ANY VIEW YES

DBA DROP ANY TYPE YES

DBA ALTER ANY TYPE YES

DBA ALTER ANY MATERIALIZED VIEW YES

DBA CREATE PROFILE YES

DBA DROP PUBLIC DATABASE LINK YES

DBA ALTER ANY INDEX YES

DBA CREATE CLUSTER YES

DBA COMMENT ANY TABLE YES

DBA DROP ANY TABLE YES

DBA CREATE ROLLBACK SEGMENT YES

DBA AUDIT SYSTEM YES

DBA ALTER SYSTEM YES

DBA MANAGE ANY FILE GROUP YES

DBA EXECUTE ANY CLASS YES

DBA DROP ANY RULE SET YES

DBA DEBUG CONNECT SESSION YES

DBA ON COMMIT REFRESH YES

DBA ENQUEUE ANY QUEUE YES

DBA CREATE ANY INDEXTYPE YES

DBA CREATE ANY TYPE YES

DBA DROP ANY DIRECTORY YES

DBA ALTER RESOURCE COST YES

DBA CREATE ANY PROCEDURE YES

DBA CREATE PROCEDURE YES

DBA FORCE TRANSACTION YES

DBA ALTER ANY SEQUENCE YES

DBA CREATE SEQUENCE YES

DBA CREATE ANY VIEW YES

DBA DROP PUBLIC SYNONYM YES

DBA DROP ANY SYNONYM YES

DBA CREATE ANY CLUSTER YES

DBA BACKUP ANY TABLE YES

DBA CREATE TABLE YES

DBA ADMINISTER SQL TUNING SET YES

DBA MERGE ANY VIEW YES

DBA DROP ANY OUTLINE YES

DBA CREATE OPERATOR YES

DBA CREATE LIBRARY YES

DBA GRANT ANY PRIVILEGE YES

DBA DROP PROFILE YES

DBA ALTER ANY TRIGGER YES

DBA CREATE ANY TRIGGER YES

DBA DROP ANY PROCEDURE YES

DBA AUDIT ANY YES

DBA DROP ANY ROLE YES

DBA DROP ANY SEQUENCE YES

DBA CREATE PUBLIC SYNONYM YES

DBA CREATE SYNONYM YES

DBA DROP ANY CLUSTER YES

DBA ALTER ANY TABLE YES

DBA CREATE EXTERNAL JOB YES

DBA READ ANY FILE GROUP YES

DBA CREATE ANY SQL PROFILE YES

DBA DROP ANY SQL PROFILE YES

DBA SELECT ANY TRANSACTION YES

DBA ADVISOR YES

DBA DROP ANY RULE YES

DBA ALTER ANY RULE YES

DBA ALTER ANY EVALUATION CONTEXT YES

DBA CREATE ANY CONTEXT YES

DBA MANAGE ANY QUEUE YES

DBA GLOBAL QUERY REWRITE YES

DBA QUERY REWRITE YES

DBA DROP ANY OPERATOR YES

DBA EXECUTE ANY TYPE YES

DBA CREATE ANY MATERIALIZED VIEW YES

DBA CREATE MATERIALIZED VIEW YES

DBA CREATE PUBLIC DATABASE LINK YES

DBA CREATE DATABASE LINK YES

DBA CREATE ANY SYNONYM YES

DBA ALTER ANY CLUSTER YES

DBA DROP USER YES

DBA MANAGE TABLESPACE YES

160 rows selected.

+++++

这足以说明DBA角色的权限非常大了，因此不要轻易将DBA角色授权给管理员以外的用户。

如何查询用户具有哪些角色?

可以通过DBA_ROLE_PRIVS视图来查询

SQL> create user t1 account unlock identified by t1;

User created.

SQL> create user t2 account unlock identified by t2;

User created.

SQL> grant connect,resource to t2;

Grant succeeded.

SQL> grant dba to t1;

Grant succeeded.



下面，通过简单的实例说明权限控制：

T1用户拥有DBA角色，T2用户只有最基本的角色，现将实现T2用户对T1的所有表只读权限：

SQL> connect t1/t1

Connected.

SQL> create table t1(id number);

Table created.

SQL> grant SELECT ANY table to t2;

Grant succeeded.

SQL> connect t2/t2

Connected.

SQL> select * from t1.t1;

no rows selected

SQL> drop table t1.t1;

drop table t1.t1

*

ERROR at line 1:

ORA-01031: insufficient privileges

SQL> delete from t1.t1;

delete from t1.t1

*

ERROR at line 1:

ORA-01031: insufficient privileges

如果你的其他想实现的权限，可以通过DBA_SYS_PRIVS.PRIVILEGE字段来对应授权。

因此，如果你担心生产用户的表或存储过程或序列号等被其他用户恶意修改，你可以创建一个单独的查询用户，将生产用户的表、存储过程、序列号的只读权限赋予它，而后都通过查询用户来查询。这样就大大降低了生产的风险。

-------------------------------------------------------------------------------------------------

本文来自于我的技术博客 http://blog.csdn.net/robo23

转载请标注源文链接,否则追究法律责任!