CNDBA社区
PDB lockdown profile是一组可以控制操作的命名集。控制PDB的操作权限，是对所有用户都生效。
例如：可以控制用户禁止直行ALTER SYSTEM这样的语法。某种程度上保证了数据库的安全性。
Use the CREATE LOCKDOWN PROFILE statement to create a PDB lockdown profile. You can use PDB lockdown profiles in a multitenant container database (CDB) to restrict user operations in PDBs.
After you create a PDB lockdown profile, you can add restrictions to the profile with the ALTER LOCKDOWN PROFILE statement. You can restrict user operations associated with certain database features, options, and SQL statements.
When a lockdown profile is assigned to a PDB, users in that PDB cannot perform the operations that are the disabled for the profile. To assign a lockdown profile, set its name for the value of the PDB_LOCKDOWN initialization parameter. You can assign a lockdown profile to individual PDBs, or to all PDBs in a CDB or application container, as follows:
If you set PDB_LOCKDOWN while connected to a CDB root, then the lockdown profile applies to all PDBs in the CDB. It does not apply to the CDB root.
If you set PDB_LOCKDOWN while connected to an application root, then the lockdown profile applies to the application root and all PDBs in the application container.
If you set PDB_LOCKDOWN while connected to a particular PDB, then the lockdown profile applies to that PDB and overrides the lockdown profile for the CDB or application container, if one exists.
See Also:
SQL> create lockdown profile hbhe_prof;
Lockdown Profile created.
SQL> ALTER LOCKDOWN PROFILE hbhe_prof DISABLE STATEMENT = ('ALTER SYSTEM') clause = ('flush shared_pool');
Lockdown Profile altered.
SQL> alter system set pdb_lockdown=hbhe_prof;
System altered.
SQL> show pdbs;
CON_ID CON_NAME OPEN MODE RESTRICTED
---------- ------------------------------ ---------- ----------
2 PDB$SEED READ ONLY NO
3 PDB01 MOUNTED
SQL> alter session set container=pdb01;
Session altered.
SQL> alter system flush shared_pool;
alter system flush shared_pool
*
ERROR at line 1:
ORA-01031: insufficient privileges
删除
SQL> DROP Lockdown Profile hbhe_prof;
Lockdown Profile dropped.
版权声明：本文为博主原创文章，未经博主允许不得转载。
oracle
