postgre管理员无法访问表_授予SELECTANYTABLE权限后无法访问sys用户的表

最新推荐文章于 2024-05-07 16:56:36 发布

小桃气

最新推荐文章于 2024-05-07 16:56:36 发布

阅读量229

点赞数

文章标签： postgre管理员无法访问表

本文链接：https://blog.csdn.net/weixin_28964839/article/details/111968586

版权

在PostgreSQL中，当O7_DICTIONARY_ACCESSIBILITY参数设置为FALSE时，普通用户即使拥有SELECT ANY TABLE权限也无法访问sys用户的表。设置该参数为TRUE则允许访问。注意，将此参数设为TRUE可能会带来安全风险，推荐通过明确的权限授予来访问SYS schema中的特定对象。

摘要由CSDN通过智能技术生成

SQL show parameter dict NAME TYPE VALUE ------------------------------------ ----------- ------------------------- O7_DICTIONARY_ACCESSIBILITY boolean FALSE ---------缺省为false ----设置为true后普通用户拥有 select any table 权限的就可以访

SQL> show parameter dict

NAME TYPE VALUE

------------------------------------ ----------- -------------------------

O7_DICTIONARY_ACCESSIBILITY

boolean FALSE ---------缺省为false

----设置为true后普通用户拥有 select any table 权限的就可以访问 sys schema了

SQL> alter system set O7_DICTIONARY_A【本文来自鸿网互联 (http://www.68idc.cn)】CCESSIBILITY=true scope=spfile

O7_DICTIONARY_ACCESSIBILITY 会控制普通用无法直接访问sys schema

FYI：

O7_DICTIONARY_ACCESSIBILITY

Property

Description

Parameter type

Boolean

Default value

false

Modifiable

Range of values

true | false

O7_DICTIONARY_ACCESSIBILITY controls restrictions on SYSTEM privileges. If the parameter is set to true, access to objects in the SYS schema

is allowed (Oracle7 behavior). The default setting of false ensures that system privileges that allow access to objects in "any schema" do not allow access to objects in the SYSschema.

For example, if O7_DICTIONARY_ACCESSIBILITY is set to false, then the SELECT ANY TABLE privilege allows access to views or tables in any schema except

the SYSschema (data dictionary tables cannot be accessed). If O7_DICTIONARY_ACCESSIBILITY is set to false, then to access objects in the SYS schema,

the user should have SELECT ANY DICTIONARY system privilege or the user should have been granted SELECT object privilege on the specific objects. The system privilegeEXECUTE

ANY PROCEDURE allows access on the procedures in any schema except the SYS schema.

If this parameter is set to false and you need to access objects in the SYS schema, then you must be granted explicit object privileges. The following roles, which can be granted to the

database administrator, also allow access to dictionary objects:

SELECT_CATALOG_ROLE

EXECUTE_CATALOG_ROLE

DELETE_CATALOG_ROLE

本文原创发布php中文网，转载请注明出处，感谢您的尊重！