[20260602]sqlplus -R参数解析.txt

--//sqlplus -H 里面关于-R参数解析如下：
$ sqlplus -H
........
-R <level>     Sets restricted mode to disable SQL*Plus commands
               that interact with the file system.  The level can
               be 1, 2 or 3.  The most restrictive is -R 3 which
               disables all user commands interacting with the
               file system.

--//具体1，2，3级别的细节就没有详细说明。看了相关文档，kimi解析记录不全而且错误，遗漏@，总结归纳如下：

级别      值                                      含义
----------------------------------------------------------------------------------------
-R 1      一级限制                                禁用 HOST、EDIT 命令
-R 2      二级限制                                禁用 HOST、EDIT、SPOOL、STORE 命令
-R 3      三级限制                                禁用 HOST、EDIT、SPOOL、STORE、@命令
----------------------------------------------------------------------------------------
--//简单记忆1级外部命令,2级增加禁止写入文件,3级增加禁止@的调用.

被禁命令  正常功能                                限制后
-------------------------------------------------------------------------------------------------------------
HOST      执行操作系统命令(如 !ls、HOST dir)      报错：SP2-0738: Restricted command "host" not available
EDIT      调用外部编辑器编辑 SQL 缓冲区或文件     报错：SP2-0738: Restricted command "edit" not available
SPOOL     将输出重定向到文件                      报错：SP2-0738: Restricted command "spool" not available
STORE     将 SQL*Plus 环境设置保存到脚本文件      报错：SP2-0738: Restricted command "store" not available
@         调用脚本命令                            报错：SP2-0738: Restricted command "@ (START)" not available
--------------------------------------------------------------------------------------------------------------
--//实际上kimi上的解析非常不全面，没有包括@的调用问题。

--//通过简单例子说明：

1.-R 1 的限制：
$ rlsql -R 1 scott/book@book01p
SQL*Plus: Release 21.0.0.0.0 - Production on Wed Jun 3 16:29:24 2026
Version 21.3.0.0.0
Copyright (c) 1982, 2021, Oracle.  All rights reserved.
Last Successful login time: Mon Jun 01 2026 08:56:41 +08:00
Connected to:
Oracle Database 21c Enterprise Edition Release 21.0.0.0.0 - Production
Version 21.3.0.0.0

SCOTT@book01p> host pwd
SP2-0738: Restricted command "host" not available

SCOTT@book01p> edit
SP2-0738: Restricted command "edit" not available

SCOTT@book01p> spool aaa.txt
SCOTT@book01p> spool off

SCOTT@book01p> store set aaa.txt replace
Wrote file aaa.txt

SCOTT@book01p> @ seg2 dept
    SEG_MB OWNER                SEGMENT_NAME                   SEGMENT_TYPE         SEG_TABLESPACE_NAME                BLOCKS     HDRFIL     HDRBLK
---------- -------------------- ------------------------------ -------------------- ------------------------------ ---------- ---------- ----------
         0 SCOTT                DEPT                           TABLE                USERS                                   8         12        130

2.-R 2 的限制：

SCOTT@book01p> host pwd
SP2-0738: Restricted command "host" not available

SCOTT@book01p> edit
SP2-0738: Restricted command "edit" not available

SCOTT@book01p> spool aaa.txt
SP2-0738: Restricted command "spool" not available

SCOTT@book01p> store set aaa.txt replace
SP2-0738: Restricted command "store" not available

SCOTT@book01p> @ seg2 dept
    SEG_MB OWNER                SEGMENT_NAME                   SEGMENT_TYPE         SEG_TABLESPACE_NAME                BLOCKS     HDRFIL     HDRBLK
---------- -------------------- ------------------------------ -------------------- ------------------------------ ---------- ---------- ----------
         0 SCOTT                DEPT                           TABLE                USERS                                   8         12        130

3.-R 3 的限制：

$ rlsql -R 3 scott/book@book01p

SQL*Plus: Release 21.0.0.0.0 - Production on Wed Jun 3 16:39:16 2026
Version 21.3.0.0.0

Copyright (c) 1982, 2021, Oracle.  All rights reserved.

Last Successful login time: Mon Jun 01 2026 08:56:41 +08:00

Connected to:
Oracle Database 21c Enterprise Edition Release 21.0.0.0.0 - Production
Version 21.3.0.0.0

SQL> host pwd
SP2-0738: Restricted command "host" not available

SQL> edit
SP2-0738: Restricted command "edit" not available

SQL> spool aaa.txt
SP2-0738: Restricted command "spool" not available

SQL> store set aaa.txt replace
SP2-0738: Restricted command "store" not available

SQL> @ seg2 dept
SP2-0738: Restricted command "@ (START)" not available

--//随便解析一下-R 3级别还是会访问执行$ORACLE_HOME/sqlplus/admin/glogin.sql，比如修改glogin.sql如下：
$ grep -v "^--" /u01/app/oracle/product/21.0.0/dbhome_1/sqlplus/admin/glogin.sql
set term off
@@ zzlogin.sql
set term on
set sqlprompt '&_user.@&_connect_identifier.> '
select sysdate from dual ;

$ rlsql -R 3 scott/book@book01p
SQL*Plus: Release 21.0.0.0.0 - Production on Wed Jun 3 16:52:03 2026
Version 21.3.0.0.0
Copyright (c) 1982, 2021, Oracle.  All rights reserved.
Last Successful login time: Mon Jun 01 2026 08:56:41 +08:00
Connected to:
Oracle Database 21c Enterprise Edition Release 21.0.0.0.0 - Production
Version 21.3.0.0.0

SYSDATE
-------------------
2026-06-03 16:52:03

SCOTT@book01p>
--//提示符修改了。

--//但是环境变量ORACLE_PATH，SQLPATH里面的login.sql以及gloin.sql不会访问。
--//可以使用strace跟踪看看，例子无-R参数：
$ strace -e open sqlplus scott/book@book01p
....
Last Successful login time: Mon Jun 01 2026 08:56:41 +08:00

Connected to:
Oracle Database 21c Enterprise Edition Release 21.0.0.0.0 - Production
Version 21.3.0.0.0

open("/home/oracle/sqllaji/tpt/login.sql", O_RDONLY) = 10
open("/u01/app/oracle/product/21.0.0/dbhome_1/sqlplus/admin/glogin.sql", O_RDONLY) = 11
open("/u01/app/oracle/product/21.0.0/dbhome_1/sqlplus/admin/zzlogin.sql", O_RDONLY) = 12
open("/home/oracle/sqllaji/tpt/init.sql", O_RDONLY) = 11

--//执行顺序有点奇怪，优先打开ORACLE_PATH，SQLPATH里面的login.sql以及gloin.sql，但是并不马上执行，最后才执行。
--//因为tpt的login。sql文件会调用tpt的init.sql脚本。