Oracle security procedure

In Oracle, - I want to ensure that owner of trigger must match table owner. - Also the views should be restricted. The 开发者_StackOverflow中文版user must not be able to query system views and tables.

Generally only the owner of a table will have privileges to create triggers on it. DBAs may have the privilege CREATE ANY TRIGGER, but protecting a database from a DBA is whole different order of question.

There are a number of system views (eg USER_TABLES, ALL_USERS) which you can't revoke access on, but they will only reveal what the user has been granted access to. Again the DBA will have access to views prefixed DBA_ and 'views' prefixed V$ (which are a bit odd in that they show operational information about the database and not data that is stored on disk anywhere) and tables owned by SYS.

What exactly is it that you want to accomplish? Normally, we create roles that give access to only the application tables and views. The owner of the application grants privileges to those roles and the roles are granted to your users. As long as the owner of the tables only has the regular 'create xxx' privileges, there is not much to worry for. Normally we need access to some system tables and views.

What data do you want to hide? Most of the views don't reveal more than already is known by the application.

Don't give 'xxxx ANY' privileges to anyone. Most of the time when those privs are requested it is because of laziness. They are rarely needed.

Ronald.