| execute on dbms_lock [message #670406] |
Tue, 03 July 2018 04:45  |
John Watson
Messages: 8962
Registered: January 2010
Location: Global Village
|
Senior Member |
|
|
For a process I'm developing, it would be helpful if I grant execute on dbms_lock to public. Does anyone think there would be a problem with doing this?
I notice that in release 18 dbms_lock.sleep is deprecated and replaced with dbms_session.sleep, so Uncle Oracle must think that dbms_lock could cause problems.
Thank you for any insight.
[Updated on: Tue, 03 July 2018 05:24] Report message to a moderator |
|
|
|
| Re: execute on dbms_lock [message #670427 is a reply to message #670406] |
Wed, 04 July 2018 03:19  |
Frank Naude
Messages: 4587
Registered: April 1998
|
Senior Member |
|
|
Granting DBMS_LOCK to PUBLIC may expose your database to DoS attacks.
https://docs.oracle.com/en/database/oracle/oracle-database/18/arpls/DBMS_LOCK.htmlThere might be operating system-specific limits on the maximum number of total locks available. This must be considered when using locks or making this package available to other users. Consider granting the EXECUTE privilege only to specific users or roles.
...
A better alternative would be to create a cover package limiting the number of locks used and grant EXECUTE privilege to specific users.
|
|
|
|
| Re: execute on dbms_lock [message #670433 is a reply to message #670427] |
Wed, 04 July 2018 08:55 |
John Watson
Messages: 8962
Registered: January 2010
Location: Global Village
|
Senior Member |
|
|
Ah, I hadn't thought of a DoS attack. It isn't a problem in this case, as the only S the client would be D'ing would be his own access. None the less, I guess I'd better try to find another way.
Thank you.
|
|
|
|
] 
Blog
Search
Help
Members
Register
Login
Home
