Checking Module to Prevent SQL Plus usage on Database

Question

I have a question regarding logon triggers checking against SYS_CONTEXT('USERENV', 'MODULE'). I created a logon trigger that looks for SYS_CONTEXT('USERENV', 'MODULE') = 'SQLPLUS.EXE'
and if it matches then it only allows specified users to log in to the database. This code works but I am confused as to why when I check SYS_CONTEXT('USERENV', 'MODULE') after I login in
shows SQL*Plus which clearly does not match my IF statement in my logon trigger.
Second issue. If I rename sqlplus.exe to jeff.exe and run it I am abled to log in to the database as a non DBA user. But the module still shows as SQL*Plus. Why is this?
Database Version: 11.2.0.2 64bit
OS: Windows Server 2003 R2
Client: 11.2.0.1
/*********************Create Trigger******************************/
CREATE OR REPLACE TRIGGER application_check_al
  after logon ON database 
DECLARE
  l_username VARCHAR2(20);
  l_module   VARCHAR2(20);
BEGIN
  l_username := SYS_CONTEXT('USERENV', 'SESSION_USER');
  l_module   := UPPER(SYS_CONTEXT('USERENV', 'MODULE'));
  IF l_module LIKE 'SQLPLUS.EXE' AND
     l_username NOT IN ('SYS', 'SYSTEM', 'DVOWNER', 'DVMGR') THEN
    raise_application_error(-20001, 'SQLPLUS ACCESS RESTRICTED FOR NON DBA USERS');
  END IF;
END application_check_al;
/*********************Run SQLPLUS******************************/
SQL*Plus: Release 11.2.0.1.0 Production on Wed Mar 7 12:22:23 2012
Copyright (c) 1982, 2010, Oracle.  All rights reserved.
Enter user-name: jeffc@dev
Enter password:
ERROR:
ORA-00604: error occurred at recursive SQL level 1
ORA-20001: SQLPLUS ACCESS RESTRICTED FOR NON DBA USERS
ORA-06512: at line 10
Enter user-name: system@dev
Enter password:
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.2.0 - 64bit Production
With the Partitioning, OLAP, Data Mining, Oracle Database Vault
and Real Application Testing options
system@dev> select sys_context('USERENV','MODULE') from dual;
SYS_CONTEXT('USERENV','MODULE')
SQL*Plus
SQL>

Answer 1

jeff81 wrote:
That doesn't make sense. Why am I able to log in when I renamed the exe? And why does the module still show as SQL*Plus?You are right - it does not make sense. The idea that Oracle might perhaps set module to SQLPLUS.EXE on executable start, and then re set from SQLPLUS.EXE to SQL*Plus after connect, or in glogin.sql, to ensure it is consistent across all operating system never crossed my mind.
You might want to refer to Support Note "SQL*Plus Session/Module is Not Showing in V$SESSION" [ID 1312340.1] to see whether anything in there helps. I'm pretty sure http://docs.oracle.com/cd/E11882_01/server.112/e16604/ch_twelve040.htm#i2698573 doesn't help much, though.
I'd certainly be raising it with Support as a potential security challenge, to get that potential hole closed.
Edited by: Hans Forbrich on Mar 7, 2012 2:23 PM
I wonder whether Oracle put that capability in there - if an untained SQLPLUS.EXE, it tells you that it is SQLPLUS.EXE, but if renamed it tells you 'SQL*Plus'? Specuklation, but it is one thing I might do to subtly raise the flag. Best bet - ask Support.
Edited by: Hans Forbrich on Mar 7, 2012 2:29 PM