Security about SYSTEM and SYS users

Question

Guys,
Just curiosity,
1) What happens if I logged with a user that have DBA role or DROP USER privilege and to drop the SYSTEM or SYS user ? This is possible ? If yes, how can protect them ?
2) I know that the SYS is owner of the dictionary and catalog, but what is the objective of the SYSTEM user to exists ?
Tank you.

Answer 1

Hi,
As you say, SYS is the owner of the database and the owner of the data dictionary.
But SYS has the SYSDBA privilege which SYSTEM doesn't. This makes it possible for SYS to become a very very powerful user. In addition, never ever create objects in the SYS schema. SYSTEM is a privileged administration user, and typically owns Oracle provided tables other than the dictionary.
Making a test.
oracle@linux:~> sqlplus
SQL*Plus: Release 9.2.0.4.0 - Production on Thu Dec 7 08:55:51 2006
Copyright (c) 1982, 2002, Oracle Corporation. All rights reserved.
Enter user-name: / as sysdba
Connected to an idle instance.
SQL> startup
ORACLE instance started.
Total System Global Area 126948772 bytes
Fixed Size 452004 bytes
Variable Size 104857600 bytes
Database Buffers 20971520 bytes
Redo Buffers 667648 bytes
Database mounted.
Database opened.
As Frederic showed
SQL> drop user sys cascade;
drop user sys cascade
ERROR at line 1:
ORA-01031: insufficient privileges
SQL> drop user system cascade;
User dropped.
SQL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup
ORACLE instance started.
Total System Global Area 126948772 bytes
Fixed Size 452004 bytes
Variable Size 104857600 bytes
Database Buffers 20971520 bytes
Redo Buffers 667648 bytes
Database mounted.
Database opened.
SQL>
If you like to protect it, you can do this below:
eg:
create table secured_objects(object_name varchar2(30));
Table created.
SQL> insert into secured_objects values ('SYSTEM');
1 row created.
SQL> select * from secured_objects;
OBJECT_NAME
SYSTEM
1 rows selected.
create or replace trigger check_beforedrop
before drop on database
declare
oname char(30);
begin
select object_name into oname from secured_objects
where upper(object_name)=ora_dict_obj_name;
if sql%found then
RAISE_APPLICATION_ERROR(-20001,'You have not permission to drop this object.');
end if;
exception
when no_data_found
then dbms_output.put_line('This object was dropped.');
end;
SQL> drop user system cascade;
drop user system
ERROR at line 1:
ORA-00604: error occurred at recursive SQL level 1
ORA-20001: You have not permission to drop this object.
ORA-06512: at line 7
Reference: http://www.adp-gmbh.ch/ora/misc/sys_system_internal.html
Cheers