Home » RDBMS Server » Server Administration » Oracle DIRECTORY object (Oracle 10g, Unix)
Oracle DIRECTORY object [message #334153] Tue, 15 July 2008 09:51 Go to next message
gkrishn
Messages: 506
Registered: December 2005
Location: Putty a dark screen
Senior Member
Is it a security threat to grant CREATE ANY DIRECTORY privilege to a user ?

I have only two options in front of me to create a directory.
1)create in SYS schema , and grant READ/WRITE to a application user.
2)grant CREATE ANY DIRECTORY to application user and create directories connecting as application user .

Finaly, i have to zero in to second option as creating a user object in SYS schema is not a recommended method ... any idea if that is a security threat going for second option ..

Any experience ??
Re: Oracle DIRECTORY object [message #334155 is a reply to message #334153] Tue, 15 July 2008 09:55 Go to previous messageGo to next message
Mahesh Rajendran
Messages: 10672
Registered: March 2002
Location: oracleDocoVille
Senior Member
Account Moderator
Well,
you are giving access to any directory (ie, any underlying filesystem accessible)in server.
The "application user" must have knowledge on available directories, else the files would end up anywhere ( / or /tmp).

And anyone can go crazy anytime Smile


[Updated on: Tue, 15 July 2008 09:59]

Report message to a moderator

Re: Oracle DIRECTORY object [message #334156 is a reply to message #334153] Tue, 15 July 2008 09:56 Go to previous messageGo to next message
Michel Cadot
Messages: 64119
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator
Quote:
Is it a security threat to grant CREATE ANY DIRECTORY privilege to a user ?

Yes, for sure.
Imagine it create a directory for your datafile directory and overwrite the files...

Quote:
1)create in SYS schema , and grant READ/WRITE to a application user.

A directory is ALWAYS in SYS schema.

Directory is part of the application like table.
Create the directory at application installation/upgrade, there is no reason to create them on the fly.

Regards
Michel
Re: Oracle DIRECTORY object [message #334158 is a reply to message #334153] Tue, 15 July 2008 10:04 Go to previous message
gkrishn
Messages: 506
Registered: December 2005
Location: Putty a dark screen
Senior Member
Its a DEV database.

Thanks Mike,Mahesh .


That being a threat , i have decided to create in SYS itself Razz only thing is i need to give a strong hint to app team that, this should be carried to production as well during the migration.
Previous Topic: How can I change character set of existing Oracle DB (11g)
Next Topic: max concurrent sessions connected
Goto Forum:
  


Current Time: Tue Dec 06 10:05:32 CST 2016

Total time taken to generate the page: 0.10478 seconds