规则约束

• 所有涉及update、delete规则项，均不支持多表操作审核。
• update、delete多表操作仅支持规则项：“不应用单条update、delete语句对多个表实现更新、删除操作”。
• 对于这两个规则，“在PL/pgSQL中，关键字建议大写，非关键字小写”、“sql语句中，关键字建议大写，非关键字小写”，不要在以对象名作为非保留关键字的语句中使用，存在审核不准确情况，比如：SELECT ID FROM name，name是非保留关键字。
• “查询系统视图时，如果使用对象名作为筛选条件，对象名应使用小写”支持的系统视图参见表2。
• “谨慎删除数据库对象及清理数据”，其中阈值中支持审核SQL语法见表表3

  表2 视图审核

  视图名	所属schema	表示对象名的列
  adm_arguments	pg_catalog、sys	owner、object_name、package_name、argument_name
  adm_audit_object	pg_catalog、sys	username、owner、obj_name、action_name
  adm_audit_session	pg_catalog、sys	username、action_name
  adm_audit_statement	pg_catalog、sys	username、obj_name、action_name
  adm_col_comments	pg_catalog、sys	owner、table_name、column_name、schema
  adm_col_privs	pg_catalog、sys	grantor、owner、grantee、table_schema、table_name、column_name、privilege
  adm_coll_types	pg_catalog、sys	owner、type_name、elem_type_mod、elem_type_owner、elem_type_name
  adm_constraints	pg_catalog、sys	owner、constraint_name、table_name、index_owner、index_name
  adm_indexes	pg_catalog、sys	owner、index_name、table_name、table_owner、tablespace_name
  adm_ind_columns	pg_catalog、sys	index_owner、index_name、table_name、table_owner、column_name
  adm_objects	pg_catalog、sys	owner、object_name、subobject_name
  adm_procedures	pg_catalog、sys	owner、object_name、procedure_name、impltypeowner、impltypename
  adm_role_privs	pg_catalog、sys	grantee、granted_role
  adm_tab_col_statistics	pg_catalog、sys	owner、table_name、column_name、schema
  adm_roles	pg_catalog、sys	role
  adm_source	pg_catalog、sys	owner、name
  adm_sys_privs	pg_catalog、sys	grantee、privilege
  adm_tab_cols	pg_catalog、sys	owner、table_name、column_name、data_type_owner、schema、qualified_col_name
  adm_tab_privs	pg_catalog、sys	grantee、owner、table_name、grantor、privilege
  adm_tables	pg_catalog、sys	owner、table_name、tablespace_name
  adm_tab_columns	pg_catalog、sys	owner、table_name、column_name、data_type_owner、schema
  adm_tab_comments	pg_catalog、sys	owner、table_name、column_name、schema
  adm_tab_statistics	pg_catalog、sys	owner、table_name
  adm_triggers	pg_catalog、sys	owner、trigger_name、table_owner、table_name
  adm_type_attrs	pg_catalog、sys	type_name、attr_name、attr_type_name、character_set_name
  adm_types	pg_catalog、sys	owner、type_name
  adm_users	pg_catalog、sys	username、default_tablespace、temporary_tablespace、default_collation
  adm_views	pg_catalog、sys	owner、view_name
  db_all_tables	pg_catalog、sys	owner、table_name、tablespace_name
  db_arguments	pg_catalog、sys	owner、object_name、package_name、argument_name
  db_col_comments	pg_catalog、sys	owner、table_name、column_name、schema
  db_col_privs	pg_catalog、sys	grantor、owner、grantee、table_schema、table_name、column_name、privilege
  db_coll_types	pg_catalog、sys	owner、type_name、elem_type_mod、elem_type_owner、elem_type_name
  db_constraints	pg_catalog、sys	owner、constraint_name、table_name、index_owner、index_name
  db_indexes	pg_catalog、sys	owner、index_name、table_name、table_owner、tablespace_name
  db_ind_columns	pg_catalog、sys	index_owner、index_name、table_name、table_owner、column_name
  db_objects	pg_catalog、sys	owner、object_name、subobject_name
  db_procedures	pg_catalog、sys	owner、object_name
  db_tab_col_statistics	pg_catalog、sys	owner、table_name、column_name、schema
  db_source	pg_catalog、sys	owner、name
  db_tab_columns	pg_catalog、sys	owner、table_name、column_name、data_type_owner、schema
  db_tab_comments	pg_catalog、sys	owner、table_name、schema
  db_tables	pg_catalog、sys	owner、table_name、tablespace_name
  db_triggers	pg_catalog、sys	trigger_name、table_owner、table_name
  db_types	pg_catalog、sys	owner、type_name
  db_users	pg_catalog、sys	username
  db_views	pg_catalog、sys	owner、view_name
  dict	pg_catalog、sys	table_name
  dictionary	pg_catalog、sys	table_name
  my_col_comments	pg_catalog、sys	owner、table_name、column_name、schema
  my_col_privs	pg_catalog、sys	grantor、owner、grantee、table_schema、table_name、column_name、privilege
  my_coll_types	pg_catalog、sys	owner、type_name、elem_type_mod、elem_type_owner、elem_type_name
  my_constraints	pg_catalog、sys	owner、constraint_name、table_name、index_owner、index_name
  my_indexes	pg_catalog、sys	owner、index_name、table_name、table_owner、tablespace_name
  my_ind_columns	pg_catalog、sys	index_owner、index_name、table_name、table_owner、column_name
  my_objects	pg_catalog、sys	object_name、subobject_name
  my_procedures	pg_catalog、sys	owner、object_name、procedure_name、impltypeowner、impltypename
  my_role_privs	pg_catalog、sys	grantee、granted_role
  my_tab_col_statistics	pg_catalog、sys	table_name、column_name、schema
  my_source	pg_catalog、sys	owner、name
  my_tab_columns	pg_catalog、sys	owner、table_name、column_name、data_type_owner、schema
  my_tab_comments	pg_catalog、sys	owner、table_name、column_name、schema
  my_tab_statistics	pg_catalog、sys	table_name
  my_tables	pg_catalog、sys	owner、table_name、tablespace_name
  my_triggers	pg_catalog、sys	owner、trigger_name、table_owner、table_name
  my_type_attrs	pg_catalog、sys	type_name、attr_name、attr_type_name、character_set_name
  my_types	pg_catalog、sys	type_name
  my_views	pg_catalog、sys	owner、view_name
  pg_indexes	pg_catalog、sys	schemaname、tablename、indexname、tablespace
  pg_roles	pg_catalog、sys	rolename
  pg_tables	pg_catalog、sys	schemaname、tablename、tableowner、tablespace、tablecreator
  pg_user	pg_catalog、sys	username、nodegroup
  pg_views	pg_catalog、sys	schemaname、viewname、viewowner
  column_privileges	information_schema、sys	grantor、grantee、table_catalog、table_schema、table_name、column_name
  columns	information_schema、sys	table_catalog、table_schema、table_name、column_name
  constraint_column_usage	information_schema、sys	table_catalog、table_schema、table_name、column_name、constraint_catalog、constraint_schema、constraint_name
  constraint_table_usage	information_schema、sys	table_catalog、table_schema、table_name、constraint_catalog、constraint_schema、constraint_name
  enabled_roles	information_schema、sys	role_name
  schemata	information_schema、sys	catalog_name、schema_name、schema_owner、default_character_set_catalog、default_character_set_schema、default_character_set_name
  table_constraints	information_schema、sys	constraint_catalog、constraint_schema、constraint_name、table_catalog、table_schema、table_name
  table_privileges	information_schema、sys	grantor、grantee、table_catalog、table_schema、table_name
  tables	information_schema、sys	table_catalog、table_schema、table_name、self_referencing_column_name、user_defined_type_catalog、user_defined_type_schema、user_defined_type_name
  triggers	information_schema、sys	trigger_catalog、trigger_schema、trigger_name、event_object_catalog、event_object_schema、event_object_table、action_reference_old_table、action_reference_new_table
  usage_privileges	information_schema、sys	grantor、grantee、object_catalog、object_schema、object_name
  views	information_schema、sys	table_catalog、table_schema、table_name

  表3 支持审核的SQL语法

  DDL类型	SQL语法
  DROP	DROP TABLE, DROP TABLESPACE, DROP AGGREGATE, DROP AUDIT POLICY, DROP CAST, DROP DATABASE, DROP DATA SOURCE, DROP DIRECTORY, DROP EVENT, DROP FOREIGN TABLE, DROP GLOBAL CONFIGURATION, DROP GROUP, DROP MASKING POLICY, DROP MATERIALIZED VIEW, DROP MODEL, DROP OPERATOR, DROP OWNED, DROP PACKAGE, DROP PACKAGE BODY, DROP PROCEDURE, DROP RESOURCE LABEL, DROP RESOURCE POOL, DROP ROLE, DROP ROW LEVEL SECURITY POLICY, DROP RULE, DROP PUBLICATION, DROP SCHEMA, DROP SEQUENCE, DROP FUNCTION, DROP SERVER, DROP SUBSCRIPTION, DROP SYNONYM, DROP TEXT SEARCH CONFIGURATION, DROP TEXT SEARCH DICTIONARY, DROP TRIGGER, DROP TYPE, DROP USER, DROP USER MAPPING, DROP VIEW, DROP WEAK PASSWORD DICTIONARY
  ALTER	ALTER DROP PARTITION, ALTER TRUNCATE PARTITION, ALTER DROP COLUMN, ALTER DROP CONSTRAINT, ALTER DROP FOREIGN TABLE, ALTER DROP AUDIT POLICY, ALTER DROP MASKING POLICY, ALTER DROP SERVER, ALTER DROP TEXT SEARCH CONFIGURATION, ALTER DROP USER MAPPING, ALTER DROP DATA SOURCE
  TRUNCATE	TRUNCATE