oracle create any trigger,Grant create any trigger vs grant create trigger

最新推荐文章于 2024-07-09 11:16:21 发布

芥末咖啡机

最新推荐文章于 2024-07-09 11:16:21 发布

阅读量444

点赞数

文章标签： oracle create any trigger

博客讨论了数据库中的触发器所有权与权限问题。创建任何触发器的权限可能导致重大安全漏洞，因为用户可以为他们拥有或能插入数据的表创建特权用户的触发器，并迫使触发器以触发器所有者的权限执行代码。建议限制此类权限并进行适当审计。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

In most cases, the trigger owner is also the owner of the table (or view) on which the trigger is based. In those cases, the table owner, with CREATE TRIGGER can create create triggers on their own table.

CREATE ANY TRIGGER allows the user to create a trigger owned by any user on any table. It is a big security hole because they can create a trigger owned by a privileged user on a table that they own or can insert into. Because they can insert into that table, they can force the trigger to execute and the trigger executes with the privileges of the trigger owner. The effect is that a user with CREATE ANY TRIGGER privilege can create and execute code as a privileged user (similar to having CREATE ANY PROCEDURE plus EXECUTE ANY PROCEDURE).

Limit to as few as people as possible and audit appropriately.