RE: [SPAM:#] Re: SYS not able to GRANT -- Strange !

From: MacGregor, Ian A. <ian_at_SLAC.Stanford.EDU>
Date: Fri, 13 Jun 2003 07:06:34 -0700
Message-ID: <F001.005B13B5.20030613064502@fatcity.com>

System can definitely grant privileges in another schema before 9. It just takes some preparation.

As system create a procedure in the other schema

CREATE OR REPLACE procedure <other_schema>.grantit (privilege in varchar2, object in varchar2, grantee in varchar2) is begin
execute immediate ('grant ' ||privilege ||' on ' ||object ||' to ' ||grantee); end;
/

Then as system invoke it as

exec <other_schema>.grantit(<privilege>, <object>, <grantee>)

This works beause the procedure runs under the security domain of the "other user", and of course because system has the ability to create and execute privileges in other schemas.

Are you on 9.0.1 or 9.2? I thought the ability to do the granting without using a procedure was available beginning with 9.2.

Ian MacGregor
Stanford Linear Accelerator Center
[EMAIL PROTECTED] -----Original Message-----
Sent: Friday, June 13, 2003 3:55 AM
To: Multiple recipients of list ORACLE-L

haven't tried it with SYS but in 9i SYSTEM (maybe any account with DBA privs -- have to try it) can definitely grant privileges on other owner's objects.

Makes my scripts that have to pass through a hosting company easy now... they have the system password, and I don't have to tell anyone the schema owner password

Rachel

• Joe Testa <[EMAIL PROTECTED]> wrote:
  > its always been that way, its not strange, sys has NEVER been able to
  > grant privs on other owner's objects.
  >
  > i think that has changed in 9i but its late and my brain is fuzzy.
  >
  > joe
  >
  >
  > Prem Khanna J wrote:
  >
  > >Guys,
  > >
  > >CONNECT SYS AS SYSDBA;
  > >
  > > create user testuser1 identified by testuser1 ;
  > > grant connect, resource to testuser1;
  > >
  > > create user testuser2 identified by testuser2 ;
  > > grant create session to testuser2;
  > >
  > > create table testuser1.table1 ( a int ) ;
  > >
  > > grant select on testuser1.table1 to testuser2;
  > > error at line 1:
  > > ora-01031: insufficient privileges
  > >
  > >WHERE AS :
  > >
  > > connect testuser1/testuser1;
  > >
  > > grant select on testuser1.table1 to testuser2;
  > >
  > > grant succeeded.
  > >
  > >
  > >why is it so ?
  > >why sys is not able to GRANT ?
  > >seems to be strange !
  > >
  > >the env. is 8.1.6.0./win2k.
  > >
  > >Jp.
  > >
  > >
  > >
  > >
  >
  > --
  > Joseph S Testa
  > Chief Technology Officer
  > Data Management Consulting
  > 614-791-9000
  > It's all about the "CACHE"
  >
  >
  > --
  > Please see the official ORACLE-L FAQ: http://www.orafaq.net
  > --
  > Author: Joe Testa
  > INET: [EMAIL PROTECTED]
  >
  > Fat City Network Services -- 858-538-5051 http://www.fatcity.com
  > San Diego, California -- Mailing list and web hosting services
  > ---------------------------------------------------------------------
  > To REMOVE yourself from this mailing list, send an E-Mail message
  > to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in
  > the message BODY, include a line containing: UNSUB ORACLE-L (or the
  > name of mailing list you want to be removed from). You may also send
  > the HELP command for other information (like subscribing).
  

  ---

Do you Yahoo!?
Yahoo! Calendar - Free online calendar with sync to Outlook(TM). http://calendar.yahoo.com

-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.net
-- 
Author: Rachel Carmichael
  INET: [EMAIL PROTECTED]

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in the message BODY, 
include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be 
removed from).  You may also send the HELP command for other information (like 
subscribing).
-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.net
-- 
Author: MacGregor, Ian A.
  INET: [EMAIL PROTECTED]

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).

Received on Fri Jun 13 2003 - 09:06:34 CDT