Oracle 安全程序
在甲骨文中， - 我想确保触发器的所有者必须与表所有者匹配。 - 观点也应该受到限制。用户不能查询系统视图和表。
In Oracle,
- I want to ensure that owner of trigger must match table owner.
- Also the views should be restricted. The user must not be able to query system views and tables.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
通常，只有表的所有者才有权限在其上创建触发器。 DBA 可能拥有 CREATE ANY TRIGGER 的权限，但是保护数据库免受 DBA 的攻击是完全不同的问题。
有许多系统视图（例如 USER_TABLES、ALL_USERS）您无法撤销其访问权限，但它们只会显示用户已被授予访问权限的内容。同样，DBA 将有权访问前缀为 DBA_ 的视图和前缀为 V$ 的“视图”（这有点奇怪，因为它们显示有关数据库的操作信息，而不是存储在磁盘上任何位置的数据）和 SYS 拥有的表。
Generally only the owner of a table will have privileges to create triggers on it. DBAs may have the privilege CREATE ANY TRIGGER, but protecting a database from a DBA is whole different order of question.
There are a number of system views (eg USER_TABLES, ALL_USERS) which you can't revoke access on, but they will only reveal what the user has been granted access to. Again the DBA will have access to views prefixed DBA_ and 'views' prefixed V$ (which are a bit odd in that they show operational information about the database and not data that is stored on disk anywhere) and tables owned by SYS.
您到底想要完成什么？
通常，我们创建仅允许访问应用程序表和视图的角色。
应用程序的所有者向这些角色授予权限，并且
这些角色已授予您的用户。
只要表的所有者仅具有常规的“create xxx”权限，就不用担心。通常我们需要访问一些系统表和视图。
您想隐藏什么数据？大多数视图所揭示的内容并不多于应用程序已知的内容。
不要向任何人授予“xxxx ANY”权限。大多数时候，请求这些权限是因为懒惰。很少需要它们。
罗纳德.
What exactly is it that you want to accomplish?
Normally, we create roles that give access to only the application tables and views.
The owner of the application grants privileges to those roles and
the roles are granted to your users.
As long as the owner of the tables only has the regular 'create xxx' privileges, there is not much to worry for. Normally we need access to some system tables and views.
What data do you want to hide? Most of the views don't reveal more than already is known by the application.
Don't give 'xxxx ANY' privileges to anyone. Most of the time when those privs are requested it is because of laziness. They are rarely needed.
Ronald.