如何在oracle中显示用户的所有权限？

Question

谁能告诉我如何在 sql-console 中显示来自特定用户的所有权限/规则？

Answer 1

您可以尝试以下这些视图。

SELECT * FROM USER_SYS_PRIVS; 
SELECT * FROM USER_TAB_PRIVS;
SELECT * FROM USER_ROLE_PRIVS;

DBA 和其他高级用户可以使用这些相同视图的DBA_ 版本找到授予其他用户的权限。它们在documentation 中进行了介绍。

这些视图只显示直接授予用户的权限。查找所有权限，包括通过角色间接授予的权限，需要更复杂的递归 SQL 语句：

select * from dba_role_privs connect by prior granted_role = grantee start with grantee = '&USER' order by 1,2,3;
select * from dba_sys_privs  where grantee = '&USER' or grantee in (select granted_role from dba_role_privs connect by prior granted_role = grantee start with grantee = '&USER') order by 1,2,3;
select * from dba_tab_privs  where grantee = '&USER' or grantee in (select granted_role from dba_role_privs connect by prior granted_role = grantee start with grantee = '&USER') order by 1,2,3,4;

Answer 2

有各种各样的脚本会根据你想要的疯狂程度来做这件事。我个人会使用 Pete Finnigan 的 find_all_privs script。

如果您想自己编写，查询会变得相当具有挑战性。用户可以被授予在DBA_SYS_PRIVS 中可见的系统权限。他们可以被授予在DBA_TAB_PRIVS 中可见的对象权限。并且他们可以被授予在DBA_ROLE_PRIVS 中可见的角色（角色可以是默认或非默认的，并且也可能需要密码，所以仅仅因为用户被授予角色并不意味着用户必须使用他默认通过角色获得的权限）。但反过来，这些角色可以被授予系统特权、对象特权和其他角色，这些角色可以通过查看ROLE_SYS_PRIVS、ROLE_TAB_PRIVS 和ROLE_ROLE_PRIVS 来查看。 Pete 的脚本遍历这些关系以显示最终流向用户的所有权限。

Answer 3

另一个有用的资源：

http://psoug.org/reference/roles.html

• DBA_SYS_PRIVS
• DBA_TAB_PRIVS
• DBA_ROLE_PRIVS

Answer 4

您可以使用以下代码获取所有用户的所有权限列表。

select * from dba_sys_privs 

Answer 5

虽然Raviteja Vutukuri's answer 可以工作并且可以快速组合在一起，但它对于更改过滤器并不是特别灵活，并且如果您希望以编程方式执行某些操作，它并没有太大帮助。所以我整理了自己的查询：

SELECT
    PRIVILEGE,
    OBJ_OWNER,
    OBJ_NAME,
    USERNAME,
    LISTAGG(GRANT_TARGET, ',') WITHIN GROUP (ORDER BY GRANT_TARGET) AS GRANT_SOURCES, -- Lists the sources of the permission
    MAX(ADMIN_OR_GRANT_OPT) AS ADMIN_OR_GRANT_OPT, -- MAX acts as a Boolean OR by picking 'YES' over 'NO'
    MAX(HIERARCHY_OPT) AS HIERARCHY_OPT -- MAX acts as a Boolean OR by picking 'YES' over 'NO'
FROM (
    -- Gets all roles a user has, even inherited ones
    WITH ALL_ROLES_FOR_USER AS (
        SELECT DISTINCT CONNECT_BY_ROOT GRANTEE AS GRANTED_USER, GRANTED_ROLE
        FROM DBA_ROLE_PRIVS
        CONNECT BY GRANTEE = PRIOR GRANTED_ROLE
    )
    SELECT
        PRIVILEGE,
        OBJ_OWNER,
        OBJ_NAME,
        USERNAME,
        REPLACE(GRANT_TARGET, USERNAME, 'Direct to user') AS GRANT_TARGET,
        ADMIN_OR_GRANT_OPT,
        HIERARCHY_OPT
    FROM (
        -- System privileges granted directly to users
        SELECT PRIVILEGE, NULL AS OBJ_OWNER, NULL AS OBJ_NAME, GRANTEE AS USERNAME, GRANTEE AS GRANT_TARGET, ADMIN_OPTION AS ADMIN_OR_GRANT_OPT, NULL AS HIERARCHY_OPT
        FROM DBA_SYS_PRIVS
        WHERE GRANTEE IN (SELECT USERNAME FROM DBA_USERS)
        UNION ALL
        -- System privileges granted users through roles
        SELECT PRIVILEGE, NULL AS OBJ_OWNER, NULL AS OBJ_NAME, ALL_ROLES_FOR_USER.GRANTED_USER AS USERNAME, GRANTEE AS GRANT_TARGET, ADMIN_OPTION AS ADMIN_OR_GRANT_OPT, NULL AS HIERARCHY_OPT
        FROM DBA_SYS_PRIVS
        JOIN ALL_ROLES_FOR_USER ON ALL_ROLES_FOR_USER.GRANTED_ROLE = DBA_SYS_PRIVS.GRANTEE
        UNION ALL
        -- Object privileges granted directly to users
        SELECT PRIVILEGE, OWNER AS OBJ_OWNER, TABLE_NAME AS OBJ_NAME, GRANTEE AS USERNAME, GRANTEE AS GRANT_TARGET, GRANTABLE, HIERARCHY
        FROM DBA_TAB_PRIVS
        WHERE GRANTEE IN (SELECT USERNAME FROM DBA_USERS)
        UNION ALL
        -- Object privileges granted users through roles
        SELECT PRIVILEGE, OWNER AS OBJ_OWNER, TABLE_NAME AS OBJ_NAME, ALL_ROLES_FOR_USER.GRANTED_USER AS USERNAME, ALL_ROLES_FOR_USER.GRANTED_ROLE AS GRANT_TARGET, GRANTABLE, HIERARCHY
        FROM DBA_TAB_PRIVS
        JOIN ALL_ROLES_FOR_USER ON ALL_ROLES_FOR_USER.GRANTED_ROLE = DBA_TAB_PRIVS.GRANTEE
    ) ALL_USER_PRIVS
    -- Adjust your filter here
    WHERE USERNAME = 'USER_NAME'
) DISTINCT_USER_PRIVS
GROUP BY
    PRIVILEGE,
    OBJ_OWNER,
    OBJ_NAME,
    USERNAME
;

优点：

• 只需更改WHERE 子句，我就可以轻松过滤许多不同的信息，例如对象、权限、是否通过特定角色等。
• 这是一个单一的查询，这意味着我不必在脑海中将结果组合在一起。
• 它解决了他们是否可以授予权限以及它是否包括跨权限不同来源的子对象（“分层”部分）的权限的问题。
• 很容易看到我需要做的所有事情来撤销权限，因为它列出了权限的所有来源。
• 它将表和系统权限组合到一个统一的视图中，使我们能够一举列出所有用户的权限。
• 这是一个查询，而不是一个将所有这些信息发送到DBMS_OUTPUT 或其他东西的函数（与Pete Finnigan 的链接脚本相比）。这使其可用于编程使用和导出。
• 过滤器不重复；它只出现一次。这样更容易更改。
• 如果您需要逐个检查子查询GRANT，可以轻松提取子查询。

Answer 6

显示所有权限：

从 system_privilege_map 中选择名称；

Answer 7

更简单的单查询oracle版本。

WITH data 
     AS (SELECT granted_role 
         FROM   dba_role_privs 
         CONNECT BY PRIOR granted_role = grantee 
         START WITH grantee = '&USER') 
SELECT 'SYSTEM'     typ, 
       grantee      grantee, 
       privilege    priv, 
       admin_option ad, 
       '--'         tabnm, 
       '--'         colnm, 
       '--'         owner 
FROM   dba_sys_privs 
WHERE  grantee = '&USER' 
        OR grantee IN (SELECT granted_role 
                       FROM   data) 
UNION 
SELECT 'TABLE'    typ, 
       grantee    grantee, 
       privilege  priv, 
       grantable  ad, 
       table_name tabnm, 
       '--'       colnm, 
       owner      owner 
FROM   dba_tab_privs 
WHERE  grantee = '&USER' 
        OR grantee IN (SELECT granted_role 
                       FROM   data) 
ORDER  BY 1;