109. Which two statements are true regarding roles? (Choose two.)

A. A role can be granted to itself.

B. A role can be granted to PUBLIC.

C. A user can be granted only one role at any point of time.

D. The REVOKE command can be used to remove privileges but not roles from

other users.

E. Roles are named groups of related privileges that can be granted to users

or other roles.

Answer: BE

SQL> create role r1;

角色已创建。

SQL> grant create session to r1;

授权成功。

SQL> grant r1 to public;

授权成功。

SQL> grant r1 to r1;

grant r1 to r1

第 1 行出现错误:

ORA-01934: 检测到循环的角色授权

1) Roles are named groups of related privileges that you grant to users or other

roles.Roles are designed to ease the administration of end-user system and schema object

privileges.However, roles are not meant to used for application developers, because

the privileges to access schema objects within stored programmatic constructs need to

be granted directly.(Roles主要用于方便权限管理,后半句什么意思呢?什么情况下的权限需

要直接授予呢?存储过程,触发器)

2) The DBA can create a role with a password to prevent unauthorized use of the privileges

granted to the role.(角色可以加密)

3) Roles are not contained in any schema. Therefore, a user who creates a role can be

dropped with no effect on the role.(角色不属于任何用户schema,谁可以建角色呢? with

create role权限)

2 who can grant or revoke roles

1) Any user with the GRANT ANY ROLE system privilege can grant or revoke any role

except a global role to or from other users or roles of the database.

2) Any user granted a role with the ADMIN OPTION can grant or revoke that role to

or from other users or roles of the database.

3 DDL statements and Roles

Oracle avoids the dependencies on privileges received by way of roles by restricting

the use of specific privileges in certain DDL statements, The following rules outline

these privilege restrictions concerning DDL statements:

1) All system privileges and schema object privileges that permit a user to perform.

a DDL operation are usable when received through a role.(通过角色得到的DDL权限在DDL

操作中是可用的,即create view等可以)

2) All system privileges and object privileges that allow a user to perform. a DML

operation that is required to issuse a DDL statement are not usable when received through

a role.(通过角色得到的DML权限在DDL操作中不可用, 即select,insert等不可以)

DDL全称“数据库模式定义语言（Data Description Language）”；

DML全称“数据库操作语言（Data Manipulation Language）”。

ITPub博客

047-109

最新文章