ORACLE ROLE 与 USER 是相同级别的。 都存储在基表USER$ 内。
其中resource 这个ROLE比表特殊,当使用GRANT 语句将resource授予其他USER或ROLE 时,会同时额外授予其UNLIMITED TABLESPACE 系统权限。
从以下10046跟踪文件可以获取ORACLE 内部做了两次INSERT SYSAUTH$的操作。
SQL> select * from v$version;
BANNER
--------------------------------------------------------------------------------
Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64bit Production
PL/SQL Release 11.2.0.3.0 - Production
CORE 11.2.0.3.0 Production
TNS for Linux: Version 11.2.0.3.0 - Production
NLSRTL Version 11.2.0.3.0 - Production
=================10046 部分内容==================================================================
=====================
PARSING IN CURSOR #139922759874712 len=24 dep=0 uid=0 oct=17 lid=0 tim=1419206405888524 hv=106673951 ad='76f94ef8' sqlid='2q43tac35rdsz'
grant resource to sunbil
END OF STMT
PARSE #139922759874712:c=0,e=938,p=0,cr=0,cu=0,mis=1,r=0,dep=0,og=1,plh=0,tim=1419206405888338
=====================
PARSING IN CURSOR #139922759102920 len=128 dep=1 uid=0 oct=2 lid=0 tim=1419206405915968 hv=1071441001 ad='71954590' sqlid='a44413nzxtt39'
insert into sysauth$ (grantee#,privilege#,option$,sequence#) values (to_number(:1),:2,decode(:3,0,null,:3),system_grant.nextval)
END OF STMT
PARSE #139922759102920:c=0,e=1048,p=0,cr=0,cu=0,mis=1,r=0,dep=1,og=4,plh=0,tim=1419206405915966
BINDS #139922759102920:
Bind#0
oacdty=01 mxl=32(02) mxlc=00 mal=00 scl=00 pre=00
oacflg=18 fl2=0001 frm=01 csi=873 siz=32 off=0
kxsbbbfp=7fff2f6540f0 bln=32 avl=02 flg=09
value="90"
Bind#1
oacdty=02 mxl=22(22) mxlc=00 mal=00 scl=00 pre=00
oacflg=08 fl2=0001 frm=00 csi=00 siz=24 off=0
kxsbbbfp=7f424e65db08 bln=24 avl=03 flg=05
value=-15
Bind#2
oacdty=02 mxl=22(22) mxlc=00 mal=00 scl=00 pre=00
oacflg=08 fl2=0001 frm=00 csi=00 siz=24 off=0
kxsbbbfp=7f424e65db38 bln=22 avl=01 flg=05
value=0
Bind#3
No oacdef for this bind.
EXEC #139922759102920:c=5000,e=50446,p=0,cr=1,cu=4,mis=1,r=1,dep=1,og=4,plh=814087155,tim=1419206405966613
STAT #139922759102920 id=1 cnt=0 pid=0 pos=1 obj=0 op='LOAD TABLE CONVENTIONAL (cr=1 pr=0 pw=0 time=591 us)'
STAT #139922759102920 id=2 cnt=1 pid=1 pos=1 obj=360 op='SEQUENCE SYSTEM_GRANT (cr=0 pr=0 pw=0 time=111 us)'
BINDS #139922759102920:
Bind#0
oacdty=01 mxl=32(02) mxlc=00 mal=00 scl=00 pre=00
oacflg=18 fl2=0001 frm=01 csi=873 siz=32 off=0
kxsbbbfp=7fff2f6540f0 bln=32 avl=02 flg=09
value="90"
Bind#1
oacdty=02 mxl=22(22) mxlc=00 mal=00 scl=00 pre=00
oacflg=08 fl2=0001 frm=00 csi=00 siz=24 off=0
kxsbbbfp=7f424e65db08 bln=24 avl=02 flg=05
value=3
Bind#2
oacdty=02 mxl=22(22) mxlc=00 mal=00 scl=00 pre=00
oacflg=08 fl2=0001 frm=00 csi=00 siz=24 off=0
kxsbbbfp=7f424e65db38 bln=22 avl=01 flg=05
value=0
Bind#3
No oacdef for this bind.
EXEC #139922759102920:c=0,e=360,p=0,cr=0,cu=3,mis=0,r=1,dep=1,og=4,plh=814087155,tim=1419206405967239
CLOSE #139922759102920:c=0,e=10,dep=1,type=0,tim=1419206405967346
=======================================================================================
详细解读:
查询user拥有的role 及系统权限可通过如下视图:
role: user_role_privs
SQL> select * from user_role_privs;
USERNAME GRANTED_ROLE ADM DEF OS_
------------------------------ ------------------------------ --- --- ---
SUNBIL CONNECT NO YES NO
SUNBIL RESOURCE NO YES NO
sys privileges:user_sys_privs
SQL> select * from user_sys_privs;
USERNAME PRIVILEGE ADM
------------------------------ ---------------------------------------- ---
SUNBIL UNLIMITED TABLESPACE NO
此时,再验证10046记录的bind 变量的值:
bind#0 value:90 bind#1 value:-15
SQL> select user#,name from user$ where user#=90;
USER# NAME
---------- ------------------------------
90 SUNBIL
SQL> select privilege,name from system_privilege_map where privilege=-15;
PRIVILEGE NAME
---------- ----------------------------------------
-15 UNLIMITED TABLESPACE
bind#0 value:90 bind#1 value:3
SQL> select user#,name from user$ where user# in (90,3);
USER# NAME
---------- ------------------------------
3 RESOURCE
90 SUNBIL
tips:1. USER 被授予的ROLE及权限信息存在SYSAUTH$这个基表内。
2. USER与ROLE都被定义在USER$基表内,相同级别。
3. SYSTEM PRIVILEGES 定义在SYSTEM_PRIVILEGE_MAP这张表内。
4. 可通过dba_views 查看USER_ROLE_PRIVS,USER_SYS_PRIVS 等视图的定义,获取以上信息。
来自 “ ITPUB博客 ” ,链接:https://blog.itpub.net/21998432/viewspace-1381538/
,如需转载,请注明出处,否则将追究法律责任。