oracle 12cR2 新的权限组sysdg, sysbackup, sysrac, syskm

在许多公司中，各种与Oracle数据库相关的任务（如管理ASM和备份/恢复Oracle数据库）都有明确的职责分离。在过去都是使用sysdba管理所有权限如asm\DG\备份， 但是都知道sysdba除了管理系统权限外甚至还可以查看业务数据， Oracle意识到解决用户的职责分离问题，在Oracle 11g是提供了ASM的管理专用权限SYSASM,  如它可以启停ASM ，增、删ASM DISK外无法查看业务数据。

如果你有安装数据库12cR2的经历会发现数据库用户的系统组又有了新成员

for i in asmdba asmadmin oinstall dba backupdba kmdba dgdba racdba; 
do
  groupadd $i
done

从Oracle Database 12c R1开始，可以使用SYSBACKUP，SYSDG和SYSKM管理权限。从Oracle Database 12cR2开始，新增加了SYSRAC管理权限。每个新的管理权限都授予在每个管理区域所需的最低权限。新的管理权限可以避免为许多常见任务需要授予SYSDBA管理权限。

SYSBACKUP

对于RMAN备份在12cR1 之前备份用户需要授权SYSDBA， 没有较好的职责安全分享方案，在12C R1版本中引入了SYSBACKUP允许用户使用RMAN或SQLPLUS 备份恢复，但无权查看业务数据和其它越权操作。如备份登录方式是：

rman target '" / as sysbackup"'

SYSDG

与RMAN类似，Oracle还在版本12cR1中引入了一个名为SYSDG的专用权限，可以与Data Guard Broker和DGMGRL命令行界面一起使用，负责DATAGUARD相关的操作。

SYSKM

还有一个成员SYSKM，将负责所有TDE（Transparent Data Encryption）和Data Vault相关的管理操作。

SYSRAC

无法向用户授予SYSRAC权限，它只是用于Oracle Clusterware连接到数据库时的Oracle AGENT用它使用操作系统身份验证的一种方式，如srvctl 工具。 同时密码文件中也不包含该权限。

连接时的语法：

CONN[ECT] [logon] [AS {SYSOPER | SYSDBA | SYSBACKUP | SYSDG | SYSKM | SYSRAC}]
CONNECT / AS SYSDBA
CONNECT / AS SYSOPER
CONNECT / AS SYSBACKUP
CONNECT / AS SYSDG
CONNECT / AS SYSKM

注：SYSBACKUP, SYSDG, SYSKM,  SYSRAC 用户不可以删除。

下面小测一下备份

SQL> show pdbs

    CON_ID CON_NAME                       OPEN MODE  RESTRICTED
---------- ------------------------------ ---------- ----------
         2 PDB$SEED                       READ ONLY  NO
         3 PERFDB                         READ WRITE NO
         5 TTPDB                          READ WRITE NO

SQL> alter session set container=perfdb;
Session altered.

SQL> select username,account_status from dba_users where username like 'SYS%';
USERNAME                  ACCOUNT_STATUS
------------------------- --------------------------------
SYS                       OPEN
SYSTEM                    OPEN
SYS$UMF                   EXPIRED & LOCKED
SYSBACKUP                 EXPIRED & LOCKED
SYSRAC                    EXPIRED & LOCKED
SYSKM                     EXPIRED & LOCKED
SYSDG                     EXPIRED & LOCKED


SQL> create user weejar identified by weejar;
User created.

SQL> grant sysbackup to weejar;
Grant succeeded.

SQL> grant connect to weejar;
Grant succeeded.

$ sqlplus weejar/weejar@oradb

SQL*Plus: Release 18.0.0.0.0 - Production on Fri Nov 23 15:10:14 2018
Version 18.4.0.0.0
Copyright (c) 1982, 2018, Oracle.  All rights reserved.

Connected to:
Oracle Database 18c Enterprise Edition Release 18.0.0.0.0 - Production
Version 18.4.0.0.0


SQL> select * from session_privs;
PRIVILEGE
----------------------------------------
CREATE SESSION
SET CONTAINER

SQL> select * from session_roles;
ROLE
---------------------------------------------

oracle@perf-monitor:admin$sqlplus weejar/weejar@oradb as sysbackup

SQL*Plus: Release 18.0.0.0.0 - Production on Fri Nov 23 15:10:59 2018
Version 18.4.0.0.0
Copyright (c) 1982, 2018, Oracle.  All rights reserved.

Connected to:
Oracle Database 18c Enterprise Edition Release 18.0.0.0.0 - Production
Version 18.4.0.0.0

SQL> select * from session_privs;

PRIVILEGE
----------------------------------------
ALTER SYSTEM
ALTER SESSION
ALTER TABLESPACE
DROP TABLESPACE
UNLIMITED TABLESPACE
CREATE ANY TABLE
CREATE ANY CLUSTER
AUDIT ANY
ALTER DATABASE
CREATE ANY DIRECTORY
RESUMABLE
SELECT ANY DICTIONARY
SELECT ANY TRANSACTION
SYSBACKUP

SQL> select * from session_roles;
ROLE
------------------------------------------------
SELECT_CATALOG_ROLE
HS_ADMIN_SELECT_ROLE
CONNECT

Note:
no SELECT ANY TALBE权限，也无权查看业务数据。

oracle@perf-monitor:admin$rman target '"weejar/weejar@oradb"' 

Recovery Manager: Release 18.0.0.0.0 - Production on Fri Nov 23 15:12:56 2018
Version 18.4.0.0.0

Copyright (c) 1982, 2018, Oracle and/or its affiliates.  All rights reserved.

RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-00554: initialization of internal recovery manager package failed
RMAN-04005: error from target database: 
ORA-01031: insufficient privileges

oracle@perf-monitor:admin$rman target '"weejar/weejar@oradb as sysbackup"' 

Recovery Manager: Release 18.0.0.0.0 - Production on Fri Nov 23 15:13:03 2018
Version 18.4.0.0.0

Copyright (c) 1982, 2018, Oracle and/or its affiliates.  All rights reserved.
connected to target database: PERFCDB:PERFDB (DBID=46375230)

RMAN> select con_id,name from v$pdbs;

    CON_ID       NAME                    
----------       ------------------------
         3	PERFDB 
		 
RMAN> backup pluggable database perfdb;

Starting backup at 23-NOV-18
using target database control file instead of recovery catalog
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=379 device type=DISK
channel ORA_DISK_1: starting full datafile backup set
channel ORA_DISK_1: specifying datafile(s) in backup set
input datafile file number=00013 name=/home/app/oracle/oradata/PERFCDB/795C725EA5E45BFDE053F1B7608571C1/datafile/o1_mf_perfdata_fxhbojfo_.dbf
input datafile file number=00010 name=/home/app/oracle/oradata/PERFCDB/795C725EA5E45BFDE053F1B7608571C1/datafile/o1_mf_sysaux_fxfqv7m8_.dbf
input datafile file number=00009 name=/home/app/oracle/oradata/PERFCDB/795C725EA5E45BFDE053F1B7608571C1/datafile/o1_mf_system_fxfqv7lx_.dbf
input datafile file number=00011 name=/home/app/oracle/oradata/PERFCDB/795C725EA5E45BFDE053F1B7608571C1/datafile/o1_mf_undotbs1_fxfqv7m9_.dbf
input datafile file number=00012 name=/home/app/oracle/oradata/PERFCDB/795C725EA5E45BFDE053F1B7608571C1/datafile/o1_mf_users_fxfqwqn6_.dbf
channel ORA_DISK_1: starting piece 1 at 23-NOV-18
channel ORA_DISK_1: finished piece 1 at 23-NOV-18
piece handle=/home/app/oracle/product/18.1/db_1/dbs/02tius28_1_1 tag=TAG20181123T153120 comment=NONE
channel ORA_DISK_1: backup set complete, elapsed time: 00:00:25
Finished backup at 23-NOV-18

Note:

备份需要数据库开启归档模式， 另外应该看到在当前的18C中rman中是可以像SQLPLUS一样执行 SQL 的，不再像11G时的sql””.