Orcle 12c 新特性 --- 增强PDB Lockdown Profiles

程序员文章站 2022-06-03 22:45:32

...

1 说明

1.1 关于PDB Lockdown Profiles

PDB lockdown profile是一组可以控制操作的命名集。控制PDB的操作权限，是对所有用户都生效。

例如：可以控制用户禁止直行ALTER SYSTEM这样的语法。某种程度上保证了数据库的安全性。

可以限制下面四个方面的操作：

Network access features. These are operations that use the network to communicate outside the PDB. For example, the PL/SQL packages UTL_TCP, UTL_HTTP, UTL_MAIL, UTL_SNMP, UTL_INADDR, and DBMS_DEBUG_JDWP perform these kinds of operations. Currently, ACLs are used to control this kind of access to share network identity.
Common user or object access. These are operations in which a local user in the PDB can proxy through common user accounts or access objects in a common schema. These kinds of operations include adding or replacing objects in a common schema, granting privileges to common objects, accessing common directory objects, granting the INHERIT PRIVILEGES role to a common user, and manipulating a user proxy to a common user.
Operating System access. For example, you can restrict access to the UTL_FILE or DBMS_FILE_TRANSFER PL/SQL packages.
Connections. For example, you can restrict common users from connecting to the PDB or you can restrict a local user who has the SYSOPER administrative privilege from connecting to a PDB that is open in restricted mode.

2 实验

2.1 创建PDB Lockdown Profile

–登录到CDB root，然后创建Lockdown profile

SQL> create lockdown profile cndba_prof;
Lockdown Profile created.

–修改Lockdown profile，禁用刷新共享池

SQL> ALTER LOCKDOWN PROFILE cndba_prof DISABLE STATEMENT = ('ALTER SYSTEM') clause = ('flush shared_pool');

Lockdown Profile altered.

注意：一个Lockdown profile正在使用，如果修改它，会立刻生效。

2.2 启用PDB Lockdown Profile

CDB级别启用Lockdown Profile，那么就会对该CDB下的所有PDB都生效

SQL> alter system set pdb_lockdown=cndba_prof;
System altered.

PDB级别启用Lockdown Profile，则只对这个PDB生效

alter system set pdb_lockdown=cndba_prof;

2.3 登录到PDB测试是否有效

根据Lockdown profile所有限制的操作，做清空共享池操作。

SQL> alter system flush shared_pool;
alter system flush shared_pool
*
ERROR at line 1:
ORA-01031: insufficient privileges

提示没有权限操作，其他操作正常。如：

SQL>  alter system set sessions=400;
System altered.

2.4 禁用PDB Lockdown Profile

同样区分CDB级别和PDB级别设置

alter system set pdb_lockdown='';

2.5 删除PDB Lockdown Profile

SQL > DROP Lockdown Profile cndba_prof;
Lockdown Profile dropped.

关于更多PDB Lockdown Profile信息，请查看官方文档：
http://docs.oracle.com/database/122/DBSEG/configuring-privilege-and-role-authorization.htm#DBSEG-GUID-0D525203-A1A7-46BB-B9DB-03F2D1A3803F