19 Managing Privileges

19-2 Objectives Identifying system and object privileges Granting and revoking privileges Controlling operating system or password file authentication Identifying system and object privileges Granting and revoking privileges Controlling operating system or password file authentication

19-3 Managing Privileges Two types of privileges: SYSTEM: enables users to perform particular actions in the database create, alter, drop, etc. OBJECT: enables users to access and manipulate a specific object select, update, insert, exec, etc. Two types of privileges: SYSTEM: enables users to perform particular actions in the database create, alter, drop, etc. OBJECT: enables users to access and manipulate a specific object select, update, insert, exec, etc.

19-4 System Privileges There are about 126 system privileges. The ANY-keyword in the privileges signifies that users have the privilege in every schema. The GRANT command adds a privilege to a user or a group of users. The REVOKE command deletes the privileges. Users with ANY privilege can access data dictionary tables There are about 126 system privileges. The ANY-keyword in the privileges signifies that users have the privilege in every schema. The GRANT command adds a privilege to a user or a group of users. The REVOKE command deletes the privileges. Users with ANY privilege can access data dictionary tables

19-5 System Privileges: Examples CategoryExamples INDEXCREATE ANY INDEX ALTER ANY INDEX DROP ANY INDEX TABLE CREATE TABLE (includes dropping privilege, create index) CREATE ANY TABLE ALTER ANY TABLE DROP ANY TABLE (need this for truncating) SELECT ANY TABLE UPDATE ANY TABLE DELETE ANY TABLE SESSIONCREATE SESSION (need this to do anything) ALTER SESSION RESTRICTED SESSION(when db in restricted mode) TABLESPACECREATE TABLESPACE ALTER TABLESPACE DROP TABLESPACE UNLIMITED TABLESPACE

19-6 Granting System Privileges GRANT CREATE SESSION, CREATE TABLE TO user1; GRANT CREATE SESSION TO scott WITH ADMIN OPTION; (enables scott to grant the privilege or role to other users or roles) GRANT CREATE SESSION TO scott WITH ADMIN OPTION; (enables scott to grant the privilege or role to other users or roles)

19-7 SYSDBA and SYSOPER Privileges CategoryExamples SYSOPER STARTUP SHUTDOWN ALTER DATABASE OPEN | MOUNT ALTER DATABASE BACKUP CONTROLFILE ALTER TABLESPACE BEGIN/END BACKUP RECOVER DATABASE, ALTER DATABASE ARCHIVELOG RESTRICTED SESSION SYSDBASYSOPER privileges WITH ADMIN OPTION CREATE DATABASE RECOVER DATABASE UNTIL (any operation on db or objects in db) user SYSTEM not as powerful as SYS

19-8 SYSDBA and SYSOPER Privileges User SYS: -Owner of data dictionary, can make changes -Granted SYSOPER and SYSDBA roles -Can start and shutdown database User STSTEM: -Not granted SYSOPER and SYSDBA roles -Cannot start/shutdown database -Cannot modify data dictionary -Safer to be SYSTEM than SYS

19-9 Password File Authentication 1. Create the password file and set the REMOTE_LOGIN_PASSWORDFILE parameter. 2. Set REMOTE_LOGIN_ PASSWORD_FILE=EXCLUSIVE. 3. Grant SYSOPER and SYSDBA privileges to users. 4. Query V$PWFILE_USERS to verify the password file members. 1. Create the password file and set the REMOTE_LOGIN_PASSWORDFILE parameter. 2. Set REMOTE_LOGIN_ PASSWORD_FILE=EXCLUSIVE. 3. Grant SYSOPER and SYSDBA privileges to users. 4. Query V$PWFILE_USERS to verify the password file members.

19-10 Displaying System Privileges DBA_SYS_PRIVS GRANTEEGRANTEE PRIVILEGEPRIVILEGE ADMIN OPTIONADMIN OPTION SESSION_PRIVS PRIVILEGEPRIVILEGE Database Level Session Level Select * from dba_sys_privs; Select * from session_privs; (current session)

19-11 System Privilege Restrictions O7_DICTIONARY_ACCESSIBILITY = TRUE Reverts to Oracle7 behavior Removes the restrictions on system privileges with the ANY keyword Defaults to TRUE O7_DICTIONARY_ACCESSIBILITY = TRUE Reverts to Oracle7 behavior Removes the restrictions on system privileges with the ANY keyword Defaults to TRUE

19-12 Revoking System Privileges REVOKE CREATE TABLE FROM user1; (can REVOKE privileges granted with GRANT command) REVOKE CREATE TABLE FROM user1; (can REVOKE privileges granted with GRANT command) REVOKE CREATE SESSION FROM scott;

19-13 USER 1 SCOTT Revoking System Privileges Using WITH ADMIN OPTION DBA GRANT REVOKE (doesn’t cascade) REVOKE (doesn’t cascade) USER 1 SCOTT DBA

19-14 RESULT Revoking System Privileges Using WITH ADMIN OPTION DBA USER 1 SCOTT

19-15 Object Privileges Object priv.TableViewSequenceProcedure ALTER  DELETE  EXECUTE  INDEX  INSERT  REFERENCES  SELECT  UPDATE  Object priv.TableViewSequenceProcedure ALTER  DELETE  EXECUTE  INDEX  INSERT  REFERENCES  SELECT  UPDATE 

19-16 Granting Object Privileges GRANT EXECUTE ON dbms_pipe TO public; GRANT UPDATE(ename,sal) ON emp TO user1 WITH GRANT OPTION; Column (field) level grants

19-17 DBA_TAB_PRIVS Displaying Object Privileges DBA_COL_PRIVS GRANTEE OWNER TABLE_NAME GRANTOR PRIVILEGE GRANTABLE GRANTEE OWNER TABLE_NAME COLUMN_NAME GRANTOR PRIVILEGE GRANTABLE Object privileges Col specific privileges

19-18 Revoking Object Privileges REVOKE execute ON dbms_pipe FROM scott; Select * from dba_tab_privs where grantee = ‘SCOTT’; Select * from dba_col_privs;

19-19 GRAN T REVOKE Revoking Object Privileges Using WITH GRANT OPTION SCOTT USER 1 USER 2

19-20 RESULT Revoking Object Privileges Using WITH GRANT OPTION SCOTT USER 1 USER 2 Summary: revoking object privileges will cascade

19-21 Summary Controlling system and object privileges