通过创建视图来绕过表权限和WITH GRANT OPTION

Question

在Oracle中,用户只需要视图上的权限就可以从中进行SELECT,更准确地说,是视图从表中看到的内容.桌面上的权限不是必需的.

让我们考虑一下这种情况:

Table T belongs to A
A GRANT SELECT ON T to B (without GRANT OPTION)
B CREATE VIEW V AS SELECT * FROM A.T
B GRANT SELECT ON V TO C
C performing SELECT * FROM B.V

根据上面的规则,C将能够从V中进行选择,因此相当于从T中选择.这种作弊行为是什么？B有效地让C看到AT虽然C在T上没有权利而B没有GRANT OPTION.某处有安全漏洞吗？

Answer 1

你所描述的不起作用.作为用户A:

create table t (id number);

Table T created.

grant select on t to b;

Grant succeeded.

作为用户B:

create view v as select * from a.t;

View V created.

grant select on v to c;

SQL Error: ORA-01720: grant option does not exist for 'A.T'
01720. 00000 -  "grant option does not exist for '%s.%s'"
*Cause:    A grant was being performed on a view or a view was being replaced
           and the grant option was not present for an underlying object.
*Action:   Obtain the grant option on all underlying objects of the view or
           revoke existing grants on the view.

这是提到在documetation:

注意:
要将视图上的SELECT授予另一个用户,您必须拥有视图下的所有对象,或者必须已在所有这些底层对象上授予SELECT对象特权WITH GRANT OPTION.即使被授权者已经对这些底层对象具有SELECT权限,也是如此.

即使是grant any object privilege特权也没有绕过这个; 虽然肯定会有一些(强大)的特权,做一个完整的DBA 可以做到grant select on b.v to c.