看到 有人提问关于授权的问题. 不由得想多说几句. Oracle 9i 以及以下版本的数据库,默认的数据库角色有些不太合理的地方. DBA 管理的过程中,如果不太注意的话,可能会带来麻烦或者潜在的隐忧. 比如最常见的 CONNECT 角色.

User => FOO has been granted the following privileges
====================================================================
        ROLE => CONNECT which contains =>
        SYS PRIV => ALTER SESSION 		grantable => NO
        SYS PRIV => CREATE CLUSTER 		grantable => NO
        SYS PRIV => CREATE DATABASE LINK 	grantable => NO
        SYS PRIV => CREATE SEQUENCE 		grantable => NO
        SYS PRIV => CREATE SESSION 		grantable => NO
        SYS PRIV => CREATE SYNONYM 		grantable => NO
        SYS PRIV => CREATE TABLE 		grantable => NO
        SYS PRIV => CREATE VIEW 		grantable => NO

这里面的 ALTER SESSION 就是一个问题. 恶意的用户很容易利用这个权限给系统带来麻烦.举两个例子,一个是 修改当前 Session 的 cursor_sharing 参数值为 FORCE ,然后提交可触发 Oracle Bug 的查询(cursor_sharing 在 FORCE 模式下 Bug 很多) , 很容易让数据库崩溃. 或者恶意用户提交 alter session set hash_area_size ... 的修改语句, 给自己设定一个超大的 HASH_AREA_SIZE , 再提交一定的查询,也会给系统性能造成很糟糕的影响.

这个 CONNECT 角色在 Oracle 10g 中已经修改了,只有 create session 的权限.

User => FOO has been granted the following privileges
====================================================================
        ROLE => RESOURCE which contains =>
        SYS PRIV => CREATE CLUSTER 			grantable => NO
        SYS PRIV => CREATE INDEXTYPE 		grantable => NO
        SYS PRIV => CREATE OPERATOR 			grantable => NO
        SYS PRIV => CREATE PROCEDURE 		grantable => NO
        SYS PRIV => CREATE SEQUENCE 			grantable => NO
        SYS PRIV => CREATE TABLE 			grantable => NO
        SYS PRIV => CREATE TRIGGER 			grantable => NO
        SYS PRIV => CREATE TYPE 			grantable => NO
        SYS PRIV => UNLIMITED TABLESPACE 		grantable => NO