Privilege information [message #343767] |
Thu, 28 August 2008 01:53  |
nazbrian
Messages: 36 Registered: July 2008
|
Member |
|
|
Hi,
I want to restrict a user from viewing V$ views, CREATE TABLESPACE .
I want to know which table contains this information.
I checked in
dba_sys_privs
dba_role_privs
role_role_privs
role_sys_privs
Brian.
|
|
|
|
|
|
Re: Privilege information [message #343788 is a reply to message #343767] |
Thu, 28 August 2008 02:52   |
nazbrian
Messages: 36 Registered: July 2008
|
Member |
|
|
Hi Taj,
select * from dba_sys_privs where privilege = 'DBA'
select * from dba_roles where role = 'DBA'
select * from dba_role_privs where granted_role = 'DBA'
From dba_role_privs I can see that, only SYS and SYSTEM has DBA role granted.
Also, I want to restrict from viewing V$ views, which privilege I should check ?
Brian
|
|
|
|
Re: Privilege information [message #343805 is a reply to message #343767] |
Thu, 28 August 2008 03:57   |
nazbrian
Messages: 36 Registered: July 2008
|
Member |
|
|
Hi Taj,
When I login to TOAD with a user OWB_TARGET, in the ROLE section it displays "DBA", but when I query
SQL> select * from dba_role_privs where granted_role = 'DBA' ;
GRANTEE GRANTED_ROLE ADM DEF
------------------------------ ------------------------------ --- ---
SYS DBA YES YES
SYSTEM DBA YES YES
SQL>
That is why my confusion!
Brian.
|
|
|
|
Re: Privilege information [message #343813 is a reply to message #343767] |
Thu, 28 August 2008 04:22   |
nazbrian
Messages: 36 Registered: July 2008
|
Member |
|
|
Hi Taj,
Some more doubts,
1. Even after revoke SELECT ANY DICTIONARY from owb_target ;, owb_target can select from dba_data_files
2. How can I restrict a user from selecting v$xxx views?
Brian
|
|
|
|
Re: Privilege information [message #343816 is a reply to message #343767] |
Thu, 28 August 2008 04:32   |
nazbrian
Messages: 36 Registered: July 2008
|
Member |
|
|
Hi,
SQL> connect owb_target
Enter password:
Connected.
SQL> select * from session_roles;
no rows selected
SQL> select * from session_privs;
PRIVILEGE
----------------------------------------
CREATE SESSION
ALTER SESSION
UNLIMITED TABLESPACE
CREATE TABLE
CREATE SYNONYM
CREATE PUBLIC SYNONYM
DROP PUBLIC SYNONYM
CREATE VIEW
CREATE SEQUENCE
CREATE DATABASE LINK
CREATE PUBLIC DATABASE LINK
PRIVILEGE
----------------------------------------
CREATE PROCEDURE
CREATE TRIGGER
CREATE SNAPSHOT
CREATE ANY DIRECTORY
DROP ANY DIRECTORY
CREATE ANY TYPE
CREATE INDEXTYPE
GLOBAL QUERY REWRITE
CREATE DIMENSION
SELECT ANY DICTIONARY
21 rows selected.
SQL>
I have logged in as sysdba and revoked SELECT ANY DICTIONARY, But still showing as granted.
Regards,
|
|
|
|
|
|
Re: Privilege information [message #344350 is a reply to message #343767] |
Fri, 29 August 2008 08:46   |
nazbrian
Messages: 36 Registered: July 2008
|
Member |
|
|
SQL> connect owb_target
Enter password:
Connected.
SQL> select * from session_privs;
PRIVILEGE
----------------------------------------
CREATE SESSION
ALTER SESSION
UNLIMITED TABLESPACE
CREATE TABLE
CREATE SYNONYM
CREATE PUBLIC SYNONYM
DROP PUBLIC SYNONYM
CREATE VIEW
CREATE SEQUENCE
CREATE DATABASE LINK
CREATE PUBLIC DATABASE LINK
CREATE PROCEDURE
CREATE TRIGGER
CREATE SNAPSHOT
CREATE ANY DIRECTORY
DROP ANY DIRECTORY
CREATE ANY TYPE
CREATE INDEXTYPE
GLOBAL QUERY REWRITE
CREATE DIMENSION
SELECT ANY DICTIONARY
21 rows selected.
SQL>
SQL> connect sys as sysdba
Enter password:
Connected.
SQL> revoke SELECT ANY DICTIONARY from owb_target ;
revoke SELECT ANY DICTIONARY from owb_target
*
ERROR at line 1:
ORA-01952: system privileges not granted to 'OWB_TARGET'
SQL>
1. Since, SELECT ANY DICTIONARY is not graned, how it is appearing in session_privs.
2. How do I revoke SELECT ANY DICTIONARY in this case.
Thanking in advance,
Brian.
|
|
|
|
|
|
Re: Privilege information [message #344687 is a reply to message #343767] |
Mon, 01 September 2008 00:58   |
nazbrian
Messages: 36 Registered: July 2008
|
Member |
|
|
Hi,
After bouncing DB session_privs doesn't show SELECT ANY DICTIONARY.
But, My doubt is why it requires DB bounce to revoke SELECT ANY DICTIONARY.
I've done following actions.
1. Revoke SELECT ANY DICTIONARY from OWB_TARGET;
2. Still it was showing in session_privs
3. No rols were granted.
4. After bouncing the DB, session_privs doesnt show SELECT ANY DICTIONARY.
Brian.
|
|
|
|
Re: Privilege information [message #344743 is a reply to message #343767] |
Mon, 01 September 2008 02:54   |
nazbrian
Messages: 36 Registered: July 2008
|
Member |
|
|
Hi Michel,
Please find the information.
SQL> connect sys as sysdba
Enter password:
Connected.
SQL> select * from dba_sys_privs where grantee = 'OWB_TARGET' ;
GRANTEE PRIVILEGE ADM
------------------------------ ---------------------------------------- ---
OWB_TARGET CREATE VIEW NO
OWB_TARGET CREATE TABLE NO
OWB_TARGET ALTER SESSION NO
OWB_TARGET CREATE SESSION NO
OWB_TARGET CREATE SYNONYM NO
OWB_TARGET CREATE TRIGGER NO
OWB_TARGET CREATE ANY TYPE NO
OWB_TARGET CREATE SEQUENCE NO
OWB_TARGET CREATE SNAPSHOT NO
OWB_TARGET CREATE DIMENSION NO
OWB_TARGET CREATE INDEXTYPE NO
GRANTEE PRIVILEGE ADM
------------------------------ ---------------------------------------- ---
OWB_TARGET CREATE PROCEDURE NO
OWB_TARGET DROP ANY DIRECTORY NO
OWB_TARGET DROP PUBLIC SYNONYM NO
OWB_TARGET CREATE ANY DIRECTORY NO
OWB_TARGET CREATE DATABASE LINK NO
OWB_TARGET GLOBAL QUERY REWRITE NO
OWB_TARGET UNLIMITED TABLESPACE NO
OWB_TARGET CREATE PUBLIC SYNONYM NO
OWB_TARGET CREATE PUBLIC DATABASE LINK NO
20 rows selected.
SQL> select * from dba_role_privs where grantee = 'OWB_TARGET';
no rows selected
SQL>
Brian
|
|
|
|
|
|