首页 > 代码库 > 给用户授予权限时应该尽量避免ANY系统权限

给用户授予权限时应该尽量避免ANY系统权限

  Oracle推荐给用户授予权限时,给予用户可以完成操作的最小权限。应当尽量避免对用户授予包含ANY的系统权限,如SELECT ANY TABLE,
CREATE ANY TABLE等。这些包含ANY的系统权限很大,只应该授权给DBA用户,而不应该授权给普通用户。如果给非DBA用户授权ANY系统权限,则会使数据库处于不安全状态。下面的例子展示了一个用户具有了CREATE ANY PROCEDURE和EXECUTE ANY PROCEDURE权限,就可以通过其他方式获取数据库中所有的权限。

SQL> create user a identified by a;用户已创建SQL> grant create session to a;授权成功。SQL> grant create any procedure, execute any procedure to a;授权成功。SQL> conn a/a@test4已连接。SQL> select * from session_privs;PRIVILEGE----------------------------------------CREATE SESSIONCREATE ANY PROCEDUREEXECUTE ANY PROCEDURESQL> select * from session_roles;未选定行SQL> create procedure system.p_execute(p_str in varchar2) as  2  begin  3  execute immediate p_str;  4  end;  5  /过程已创建。SQL> exec system.p_execute(‘grant dba to a‘);PL/SQL 过程已成功完成。SQL> conn a/a@test4已连接。SQL> select * from session_privs;PRIVILEGE----------------------------------------ALTER SYSTEMAUDIT SYSTEMCREATE SESSIONALTER SESSIONRESTRICTED SESSION...ALTER ANY RULE SETDROP ANY RULE SETEXECUTE ANY RULE SET已选择140行。SQL> select * from session_roles;ROLE------------------------------DBASELECT_CATALOG_ROLEHS_ADMIN_ROLEEXECUTE_CATALOG_ROLEDELETE_CATALOG_ROLEEXP_FULL_DATABASEIMP_FULL_DATABASEGATHER_SYSTEM_STATISTICSWM_ADMIN_ROLE已选择9行。

授权实例,生产环境应避免any

--授权GRANTCONNECT,                RESOURCE,               --DBA,                  --unlimited tablespace,CREATE  SESSION,         CREATE ANY SEQUENCE,     CREATE ANY TABLE,        CREATE ANY VIEW ,        CREATE ANY INDEX,        CREATE ANY PROCEDURE,    CREATE ANY DIRECTORY,    ALTER  SESSION, ALTER ANY SEQUENCE,     ALTER ANY TABLE,        --ALTER ANY VIEW ,        --不能修改视图ALTER ANY INDEX,        ALTER ANY PROCEDURE,    --ALTER ANY DIRECTORY,    --不能修改目录--DROP  SESSION,       --不能删除SessionDROP ANY SEQUENCE,     DROP ANY TABLE,        DROP ANY VIEW ,        DROP ANY INDEX,        DROP ANY PROCEDURE,    DROP ANY DIRECTORY,    SELECT ANY TABLE, SELECT ANY DICTIONARY,INSERT ANY TABLE, UPDATE ANY TABLE, DELETE ANY TABLE,DEBUG ANY PROCEDURE,DEBUG CONNECT SESSION,exp_full_database,  imp_full_database     TO xcj01;

 

转自<http://blog.itpub.net/4227/viewspace-68640/>

给用户授予权限时应该尽量避免ANY系统权限