[每日一题] OCP1z0-047 :2013-07-25 权限――角色与对象权限

有疑问可以去itpub讨论：http://www.itpub.net/thread-1804842-1-1.html

按题意，操作如下：

 1、创建一个角色r1

sys@OCM> create role r1;

Role created.

 2、角色r1可以查询和插入oe用户下的orders表

sys@OCM> grant select,insert on oe.orders to r1;

Grant succeeded.

 3、把r1拥有的所有全权授权给scott用户

sys@OCM> grant r1 to scott;

Grant succeeded.

4、授予scott用户可以查oe用户下的orders表的权限

sys@OCM> grant select on oe.orders to scott;

Grant succeeded.

5、回收查oe用户下的orders表的权限

sys@OCM> revoke select on oe.orders from scott;

Revoke succeeded.

6、scott用户登录询查oe用户下的orders表

sys@OCM> conn scott/scott

Connected.scott@OCM> select * from oe.orders;

  ORDER_IDORDER_DATE                                                                 ORDER_MO CUSTOMER_ID ORDER_STATUS ORDER_TOTAL SALES_REP_ID PROMOTION_ID

--------------------------------------------------------------------------------------------- ----------- ------------ ----------- ------------ ------------

      245817-AUG-07 05.34.12.234359 AM                                               direct           101            0     78279.6            153

      239720-NOV-07 06.41.54.696211 AM                                                direct           102            1     42283.2            154

                                        direct           105            2 7826          155

    。。。。。。。。。。。省略。。。。。。。。。。。。。。。。。。。

      245118-DEC-07 09.03.52.562632 AM                                                direct           148            7     10474.6            154

                                             direct           117            0      3878.4            163

      245701-NOV-07 01.22.16.162632 PM                                               direct           118            5     21586.2            159

105 rows selected.

用revoke命令回收了scott用户查oe用户下的orders表，但

 Scott用户还是可以查出oe用户中的orders表记录。这是什么回事呢？

我们先来看角色r1的对象权限：

sys@OCM> select * from dba_tab_privs where grantee='R1';

GRANTEE                        OWNER                          TABLE_NAME                     GRANTOR                 PRIVILEGE                                 GRA HIE

------------------------------------------------------------ ------------------------------------------------------------ ---------------------------------------- --- ---

R1                             OE                             ORDERS                         OE                      SELECT                                    NO  NO

R1                             OE                             ORDERS                         OE                      INSERT                                    NO  NO

说明R1角色拥用对oe用户下对orders表的查询和插入操作的权限。。。

查SCOTT用户所拥用的角色：

sys@OCM> select * from DBA_ROLE_PRIVS whereGRANTEE='SCOTT';

GRANTEE                        GRANTED_ROLE                   ADM DEF

------------------------------------------------------------ --- ---

SCOTT                          RESOURCE                       NO  YES

SCOTT                          R1                             NO  YES

SCOTT                          CONNECT                        NO  YES

可以看出SCOTT拥有R1角色，所以有查oe用户下orders表的权限。

如果回收scott用户下的R1角色，应该就能查oe用户下orders表的权限。

sys@OCM> revoke r1 from scott;

Revoke succeeded.

sys@OCM> conn scott/scott

Connected.

scott@OCM> select * from oe.orders;

select * from oe.orders

                 *

ERROR at line 1:

ORA-00942: table or view does not exist

这道题目是考用户的权限，角色和对象权限的分配及回收知识点。

  参考：http://blog.csdn.net/guoyjoe/article/details/863593

希望大家一起补充知识点，找出每道题目的知识点，一起挖掘，分析，吃透。。。

正确答案是：A