用户权限

环境搭建

SQL> create user dev identified by oracle;

User created.

SQL> grant create session to dev;

Grant succeeded.

SQL> show user;

USER is "DEV"

一．授予用户create session 的权限

1.1 检查用户的系统权限

SQL> desc user_sys_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 USERNAME                                           VARCHAR2(30)

 PRIVILEGE                                 NOT NULL VARCHAR2(40)

 ADMIN_OPTION                                       VARCHAR2(3)

SQL> select username,privilege from user_sys_privs;

USERNAME                       PRIVILEGE

------------------------------ ----------------------------------------

DEV                        CREATE SESSION

Dev只有 创建会话 的权限

1.2 检查用户的对象权限

SQL> desc user_tab_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 GRANTEE                                   NOT NULL VARCHAR2(30)

 OWNER                                     NOT NULL VARCHAR2(30)

 TABLE_NAME                                NOT NULL VARCHAR2(30)

 GRANTOR                                   NOT NULL VARCHAR2(30)

 PRIVILEGE                                 NOT NULL VARCHAR2(40)

 GRANTABLE                                          VARCHAR2(3)

 HIERARCHY                                          VARCHAR2(3)

SQL> select table_name,privilege from user_tab_privs;

no rows selected

1.3 检查用户的角色权限

SQL> desc user_role_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 USERNAME                                           VARCHAR2(30)

 GRANTED_ROLE                                       VARCHAR2(30)

 ADMIN_OPTION                                       VARCHAR2(3)

 DEFAULT_ROLE                                       VARCHAR2(3)

 OS_GRANTED                                         VARCHAR2(3)

SQL> select username,default_role from user_role_privs;

no rows selected

1.4 检查角色的系统权限

SQL> desc role_sys_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 ROLE                                      NOT NULL VARCHAR2(30)

 PRIVILEGE                                 NOT NULL VARCHAR2(40)

 ADMIN_OPTION                                       VARCHAR2(3)

SQL> select role,privilege from role_sys_privs;

no rows selected

1.5 检查角色的对象权限

SQL> desc role_tab_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 ROLE                                      NOT NULL VARCHAR2(30)

 OWNER                                     NOT NULL VARCHAR2(30)

 TABLE_NAME                                NOT NULL VARCHAR2(30)

 COLUMN_NAME                                        VARCHAR2(30)

 PRIVILEGE                                 NOT NULL VARCHAR2(40)

 GRANTABLE                                          VARCHAR2(3)

SQL> select table_name,column_name,privilege from role_tab_privs;

no rows selected

二．授予用户select any table 的权限

SQL> grant select any table to dev;

Grant succeeded.

官方文档关于 select any table 的描述：

当把这个权限授予用户之后，用户可以查询 任何用户的 表、视图、物化视图（权限太大）

2.1 检查用户的系统权限

SQL> desc user_sys_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 USERNAME                                           VARCHAR2(30)

 PRIVILEGE                                 NOT NULL VARCHAR2(40)

 ADMIN_OPTION                                       VARCHAR2(3)

SQL> select username,privilege from user_sys_privs;

USERNAME                       PRIVILEGE

------------------------------ ----------------------------------------

DEV                        CREATE SESSION

DEV                        SELECT ANY TABLE

Dev已经有select any table 的权限

2.2 检查用户的对象权限

SQL> desc user_tab_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 GRANTEE                                   NOT NULL VARCHAR2(30)

 OWNER                                     NOT NULL VARCHAR2(30)

 TABLE_NAME                                NOT NULL VARCHAR2(30)

 GRANTOR                                   NOT NULL VARCHAR2(30)

 PRIVILEGE                                 NOT NULL VARCHAR2(40)

 GRANTABLE                                          VARCHAR2(3)

 HIERARCHY                                          VARCHAR2(3)

SQL> select table_name,privilege from user_tab_privs where table_name='EMP';

no rows selected

2.3 检查用户的角色权限

SQL> desc user_role_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 USERNAME                                           VARCHAR2(30)

 GRANTED_ROLE                                       VARCHAR2(30)

 ADMIN_OPTION                                       VARCHAR2(3)

 DEFAULT_ROLE                                       VARCHAR2(3)

 OS_GRANTED                                         VARCHAR2(3)

SQL> select username,default_role from user_role_privs;

no rows selected

2.4 检查角色的系统权限

SQL> desc role_sys_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 ROLE                                      NOT NULL VARCHAR2(30)

 PRIVILEGE                                 NOT NULL VARCHAR2(40)

 ADMIN_OPTION                                       VARCHAR2(3)

SQL> select role,privilege from role_sys_privs;

no rows selected

2.5 检查角色的对象权限

SQL> desc role_tab_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 ROLE                                      NOT NULL VARCHAR2(30)

 OWNER                                     NOT NULL VARCHAR2(30)

 TABLE_NAME                                NOT NULL VARCHAR2(30)

 COLUMN_NAME                                        VARCHAR2(30)

 PRIVILEGE                                 NOT NULL VARCHAR2(40)

 GRANTABLE                                          VARCHAR2(3)

SQL> select table_name,column_name,privilege from role_tab_privs;

no rows selected

2.6 测试

更新

SQL> update scott.emp set empno=empno*1;

update scott.emp set empno=empno*1

             *

ERROR at line 1:

ORA-01031: insufficient privileges

SQL> rollback;

Rollback complete.

删除

SQL> delete from scott.emp ;

delete from scott.emp

                  *

ERROR at line 1:

ORA-01031: insufficient privileges

SQL> rollback;

Rollback complete.

插入

SQL> insert into scott.emp(empno) values(123);

insert into scott.emp(empno) values(123)

                  *

ERROR at line 1:

ORA-01031: insufficient privileges

SQL> rollback;

Rollback complete.

三．授予用户对其他用户下 单个对象 只读的权限

SQL> grant all on scott.emp to dev;

Grant succeeded.

SQL> revoke delete on scott.emp from dev;

Revoke succeeded.

SQL> revoke update on scott.emp from dev;

Revoke succeeded.

3.1 检查用户的系统权限

SQL> desc user_sys_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 USERNAME                                           VARCHAR2(30)

 PRIVILEGE                                 NOT NULL VARCHAR2(40)

 ADMIN_OPTION                                       VARCHAR2(3)

Rollback complete.

SQL> select username,privilege from user_sys_privs;

USERNAME                       PRIVILEGE

------------------------------ ----------------------------------------

DEV                            CREATE SESSION

Dev已经有CREATE SESSION 的权限

3.2 检查用户的对象权限

SQL> desc user_tab_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 GRANTEE                                   NOT NULL VARCHAR2(30)

 OWNER                                     NOT NULL VARCHAR2(30)

 TABLE_NAME                                NOT NULL VARCHAR2(30)

 GRANTOR                                   NOT NULL VARCHAR2(30)

 PRIVILEGE                                 NOT NULL VARCHAR2(40)

 GRANTABLE                                          VARCHAR2(3)

 HIERARCHY                                          VARCHAR2(3)

SQL> select table_name,privilege from user_tab_privs;

TABLE_NAME                     PRIVILEGE

------------------------------ ----------------------------------------

EMP                            FLASHBACK

EMP                            DEBUG

EMP                            QUERY REWRITE

EMP                            ON COMMIT REFRESH

EMP                            REFERENCES

EMP                            SELECT

EMP                            INSERT

EMP                            INDEX

EMP                            ALTER

3.3 检查用户的角色权限

SQL> desc user_role_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 USERNAME                                           VARCHAR2(30)

 GRANTED_ROLE                                       VARCHAR2(30)

 ADMIN_OPTION                                       VARCHAR2(3)

 DEFAULT_ROLE                                       VARCHAR2(3)

 OS_GRANTED                                         VARCHAR2(3)

SQL>  select username,default_role from user_role_privs;

USERNAME                       DEF

------------------------------ ---

DEV                            YES

3.4 检查角色的系统权限

SQL> desc role_sys_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 ROLE                                      NOT NULL VARCHAR2(30)

 PRIVILEGE                                 NOT NULL VARCHAR2(40)

 ADMIN_OPTION                                       VARCHAR2(3)

SQL> select role,privilege from role_sys_privs;

no rows selected

3.5 检查角色的对象权限

SQL> desc role_tab_privs;

 Name                                      Null?    Type

 ----------------------------------------- -------- ----------------------------

 ROLE                                      NOT NULL VARCHAR2(30)

 OWNER                                     NOT NULL VARCHAR2(30)

 TABLE_NAME                                NOT NULL VARCHAR2(30)

 COLUMN_NAME                                        VARCHAR2(30)

 PRIVILEGE                                 NOT NULL VARCHAR2(40)

 GRANTABLE                                          VARCHAR2(3)

SQL> select table_name,column_name,privilege from role_tab_privs;

no rows selected

3.6 测试

更新

SQL> update scott.emp set empno=empno*1;

update scott.emp set empno=empno*1

             *

ERROR at line 1:

ORA-01031: insufficient privileges

SQL> rollback;

Rollback complete.

删除

SQL> delete from scott.emp ;

delete from scott.emp

                  *

ERROR at line 1:

ORA-01031: insufficient privileges

SQL> rollback;

Rollback complete.

插入

SQL> insert into scott.emp(empno) values(123);

1 row created.

SQL> commit;

Rollback complete.