Home » SQL & PL/SQL » SQL & PL/SQL » Revoke fails even with SYS (Oracle 9i release 9.2.0.8.0)
Revoke fails even with SYS [message #456413] Mon, 17 May 2010 16:02 Go to next message
Amine
Messages: 376
Registered: March 2010
Senior Member

Hi All,
I want to revoke some privileges (given from user, say A, on table TABLE to user B) with SYS, and i've got an error : It says that I can't revoke a privilege that I didn't give.

In DBA_TAB_PRIVS, there's no information about that : I can't know who gives the privilege (when I try to perform the REVOKE statment with OWNER, GRANTOR, I've got the same error).

How I have to do ?

Amine
Re: Revoke fails even with SYS [message #456416 is a reply to message #456413] Mon, 17 May 2010 16:11 Go to previous messageGo to next message
cookiemonster
Messages: 13967
Registered: September 2008
Location: Rainy Manchester
Senior Member
What does dba_tab_privs show?
Re: Revoke fails even with SYS [message #456417 is a reply to message #456413] Mon, 17 May 2010 16:12 Go to previous messageGo to next message
BlackSwan
Messages: 26766
Registered: January 2009
Location: SoCal
Senior Member
SQL> desc dba_tab_privs
 Name					   Null?    Type
 ----------------------------------------- -------- ----------------------------
 GRANTEE				   NOT NULL VARCHAR2(30)
 OWNER					   NOT NULL VARCHAR2(30)
 TABLE_NAME				   NOT NULL VARCHAR2(30)
 GRANTOR				   NOT NULL VARCHAR2(30)
 PRIVILEGE				   NOT NULL VARCHAR2(40)
 GRANTABLE					    VARCHAR2(3)
 HIERARCHY					    VARCHAR2(3)


It would be helpful if you followed Posting Guidelines - http://www.orafaq.com/forum/t/88153/0/

using COPY & PASTE post SQL you issue & how Oracle responds
Re: Revoke fails even with SYS [message #456418 is a reply to message #456417] Mon, 17 May 2010 16:41 Go to previous messageGo to next message
Amine
Messages: 376
Registered: March 2010
Senior Member

sorry I can't get them (SQL error messages) for now.
Re: Revoke fails even with SYS [message #456421 is a reply to message #456418] Mon, 17 May 2010 16:45 Go to previous messageGo to next message
BlackSwan
Messages: 26766
Registered: January 2009
Location: SoCal
Senior Member
Here is essentially what you posted.

I doing some SQL (even as SYS) & I'm getting an error.
Tell me how to make it work.

We don't know what you have.
We don't know what you do.
We don't know what you see.
It is really, really, REALLY difficult to fix a problem that can not be seen.
use COPY & PASTE so we can see what you do & how Oracle responds.

It would be helpful if you followed Posting Guidelines - http://www.orafaq.com/forum/t/88153/0/
Re: Revoke fails even with SYS [message #456422 is a reply to message #456421] Mon, 17 May 2010 16:53 Go to previous messageGo to next message
Amine
Messages: 376
Registered: March 2010
Senior Member

take it easy BlackSwan Smile you seem to be nervous, aren't you ?
I'll post the messages tomorrow after work

Best regards

Amine
Re: Revoke fails even with SYS [message #456426 is a reply to message #456422] Mon, 17 May 2010 17:04 Go to previous messageGo to next message
JRowbottom
Messages: 5933
Registered: June 2006
Location: Sunny North Yorkshire, ho...
Senior Member
@Blackswan and I don't always see eye to eye on posting style, but I'm with them on this one.

It is really really difficult to provide useful help in the absence of information.
I know the posting guidelines seem onerous, but posters that follow them do get a better class of answer, simply because we have the information that we need to provide the answer.
Re: Revoke fails even with SYS [message #456451 is a reply to message #456413] Tue, 18 May 2010 00:11 Go to previous messageGo to next message
Littlefoot
Messages: 21825
Registered: June 2005
Location: Croatia, Europe
Senior Member
Account Moderator
Amine wrote on Mon, 17 May 2010 23:02
I want to revoke some privileges (given from user, say A, on table TABLE to user B)

How do you know that GRANT exists? What privileges are we talking about (SELECT, INSERT, ...? Perhaps there is no grant at all, but USER_B operates USER_A.TABLE through a database link (so no grant is needed)?
Re: Revoke fails even with SYS [message #456587 is a reply to message #456451] Tue, 18 May 2010 11:48 Go to previous messageGo to next message
Amine
Messages: 376
Registered: March 2010
Senior Member

Hi All,
Here is a scenario for my request.
SQL> ---- create user aa
SQL> drop user aa cascade
  2  /

User dropped.

SQL> CREATE USER aa IDENTIFIED BY aa
  2  DEFAULT TABLESPACE "USERS"
  3  /

User created.

SQL> GRANT connect, resource TO aa
  2  /

Grant succeeded.

SQL> 
SQL> ---- create user bb
SQL> drop user bb cascade
  2  /

User dropped.

SQL> CREATE USER bb IDENTIFIED BY bb
  2  DEFAULT TABLESPACE "USERS"
  3  /

User created.

SQL> 
SQL> GRANT connect, resource TO bb
  2  /

Grant succeeded.

SQL> 
SQL> 
SQL> ---- create user cc
SQL> drop user cc cascade
  2  /

User dropped.

SQL> CREATE USER cc IDENTIFIED BY cc
  2  DEFAULT TABLESPACE "USERS"
  3  /

User created.

SQL> 
SQL> GRANT connect, resource TO cc
  2  /

Grant succeeded.

SQL> 
SQL> ---- create table_aa with aa
SQL> conn aa/aa
Connected.
SQL> create table table_aa
  2  (
  3  	dummy	varchar2(1000)
  4  )
  5  /

Table created.

SQL> 
SQL> 
SQL> ---- grant select to cc with grant option
SQL> grant select on table_aa to cc with grant option
  2  /

Grant succeeded.

SQL> 
SQL> 
SQL> ---- grant select to bb through cc
SQL> conn cc/cc
Connected.
SQL> grant select on aa.table_aa to bb
  2  /

Grant succeeded.

SQL> 
SQL> 
SQL> ---- revoke select from bb using system
SQL> conn system/a
Connected.
SQL> revoke select on aa.table_aa from bb
  2  /
revoke select on aa.table_aa from bb
*
ERROR at line 1:
ORA-01927: cannot REVOKE privileges you did not grant 
Re: Revoke fails even with SYS [message #456590 is a reply to message #456587] Tue, 18 May 2010 12:04 Go to previous messageGo to next message
BlackSwan
Messages: 26766
Registered: January 2009
Location: SoCal
Senior Member
>ORA-01927: cannot REVOKE privileges you did not grant
What part of error message above confuses you?

user SYSTEM did not issue the GRANT & therefore can not REVOKE it.
only user CC can issue REVOKE
Re: Revoke fails even with SYS [message #456592 is a reply to message #456587] Tue, 18 May 2010 12:09 Go to previous messageGo to next message
cookiemonster
Messages: 13967
Registered: September 2008
Location: Rainy Manchester
Senior Member
So why not just revoke the grant as cc?
The documentation implies that sys can't do this.
Re: Revoke fails even with SYS [message #456595 is a reply to message #456590] Tue, 18 May 2010 12:15 Go to previous messageGo to next message
Amine
Messages: 376
Registered: March 2010
Senior Member

I was cleaning the db. And there was lot of grants issued.
I issued this statment :
select 'revoke ' ||privilege || ' on ' 
|| grantor || '.' || table_name 
|| ' from ' || grantee
from dba_tab_privs


and I think that the right statment is :

select 'revoke ' ||privilege || ' on ' 
|| owner || '.' || table_name 
|| ' from ' || grantee
from dba_tab_privs


issued each time by grantor.

Am I right ?
Re: Revoke fails even with SYS [message #456596 is a reply to message #456595] Tue, 18 May 2010 12:21 Go to previous messageGo to next message
cookiemonster
Messages: 13967
Registered: September 2008
Location: Rainy Manchester
Senior Member
More likely:
select 'revoke ' ||privilege || ' on ' 
|| owner || '.' || table_name 
|| ' from ' || grantee
from dba_tab_privs
where grantor = user
Re: Revoke fails even with SYS [message #456597 is a reply to message #456595] Tue, 18 May 2010 12:21 Go to previous messageGo to next message
BlackSwan
Messages: 26766
Registered: January 2009
Location: SoCal
Senior Member
>Am I right ?

Yes, when you get the results you desire.
Re: Revoke fails even with SYS [message #456598 is a reply to message #456595] Tue, 18 May 2010 12:23 Go to previous messageGo to next message
Michel Cadot
Messages: 68765
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
Amine wrote on Tue, 18 May 2010 19:15

...and I think that the right statment is :

select 'revoke ' ||privilege || ' on ' 
|| owner || '.' || table_name 
|| ' from ' || grantee
from dba_tab_privs


issued each time by grantor.

Am I right ?

Right.

Regards
Michel

Re: Revoke fails even with SYS [message #456601 is a reply to message #456598] Tue, 18 May 2010 12:33 Go to previous messageGo to next message
Michel Cadot
Messages: 68765
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
And don't forget DBA_COL_PRIVS as well.

Regards
Michel
Re: Revoke fails even with SYS [message #456602 is a reply to message #456601] Tue, 18 May 2010 12:43 Go to previous messageGo to next message
Amine
Messages: 376
Registered: March 2010
Senior Member

Thank you all Wink
Re: Revoke fails even with SYS [message #456615 is a reply to message #456598] Tue, 18 May 2010 16:43 Go to previous messageGo to next message
Solomon Yakobson
Messages: 3305
Registered: January 2010
Location: Connecticut, USA
Senior Member
Michel Cadot wrote on Tue, 18 May 2010 13:23
Right.


Unless you are a DBA. Then you could use a handy SP (I have it as part of my DBA package) that uses undocumented package DBMS_SYS_SQL ("guts" of DBMS_SQL package and therefore it is highly unlikely it will be dropped). It has very handy procedure PARSE_AS_USER. Anyway, here is a simplified version of a procedure in my DBA package:

CREATE OR REPLACE
  PROCEDURE EXECUTE_AS_USER(
                            p_username VARCHAR2,
                            p_stmt     VARCHAR2
                           )
    IS
        v_cur     NUMBER;
        v_user_id NUMBER;
    BEGIN
        SELECT  MAX(user_id)
          INTO  v_user_id
          FROM  DBA_USERS
          WHERE username = UPPER(p_username);
        IF v_user_id IS NULL
          THEN
            RAISE_APPLICATION_ERROR(-20900,'User ' || p_username || ' does not exist.');
        END IF;
        v_cur := DBMS_SQL.OPEN_CURSOR;
        DBMS_SYS_SQL.PARSE_AS_USER(v_cur,p_stmt,DBMS_SQL.NATIVE,v_user_id);
        DBMS_SQL.CLOSE_CURSOR(v_cur);
END;
/


Now:

SQL> show user
USER is "SCOTT"
SQL> grant select on emp to u1 with grant option
  2  /

Grant succeeded.

SQL> connect u1/u1
Connected.
SQL> grant select on scott.emp to u2
  2  /

Grant succeeded.

SQL> connect u2/u2
Connected.
SQL> select count(*) from scott.emp
  2  /

   COUNT(*)
-----------
         14

SQL> connect scott as sysdba
Enter password: *****
Connected.
SQL> show user
USER is "SYS"
SQL> revoke select on scott.emp from u2
  2  /
revoke select on scott.emp from u2
*
ERROR at line 1:
ORA-01927: cannot REVOKE privileges you did not grant


SQL> CREATE OR REPLACE
  2    PROCEDURE EXECUTE_AS_USER(
  3                              p_username VARCHAR2,
  4                              p_stmt     VARCHAR2
  5                             )
  6      IS
  7          v_cur     NUMBER;
  8          v_user_id NUMBER;
  9      BEGIN
 10          SELECT  MAX(user_id)
 11            INTO  v_user_id
 12            FROM  DBA_USERS
 13            WHERE username = UPPER(p_username);
 14          IF v_user_id IS NULL
 15            THEN
 16              RAISE_APPLICATION_ERROR(-20900,'User ' || p_username || ' does not exist.');
 17          END IF;
 18          v_cur := DBMS_SQL.OPEN_CURSOR;
 19          DBMS_SYS_SQL.PARSE_AS_USER(v_cur,p_stmt,DBMS_SQL.NATIVE,v_user_id);
 20          DBMS_SQL.CLOSE_CURSOR(v_cur);
 21  END;
 22  /

Procedure created.

SQL> EXEC EXECUTE_AS_USER('u1','revoke select on scott.emp from u2');

PL/SQL procedure successfully completed.

SQL> connect u2/u2
Connected.
SQL> select count(*) from scott.emp
  2  /
select count(*) from scott.emp
                           *
ERROR at line 1:
ORA-00942: table or view does not exist


SQL> 


SY.
P.S. I created procedure in schema SYS just to simplify things. In real life you shouldn't create user objects in SYS schema. As I already mentioned, it is part of my DBA package owned by a highly privileged DBA_SUPPORT user.

[Updated on: Tue, 18 May 2010 16:50]

Report message to a moderator

Re: Revoke fails even with SYS [message #456632 is a reply to message #456615] Tue, 18 May 2010 23:26 Go to previous messageGo to next message
Michel Cadot
Messages: 68765
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
It is not recommended to use an internal only package you don't know what it actually does and may have some side effects.

Regards
Michel
Re: Revoke fails even with SYS [message #456785 is a reply to message #456632] Wed, 19 May 2010 08:46 Go to previous messageGo to next message
villafan
Messages: 3
Registered: May 2010
Junior Member
Really?
Re: Revoke fails even with SYS [message #456787 is a reply to message #456785] Wed, 19 May 2010 08:48 Go to previous message
Michel Cadot
Messages: 68765
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
Really!
Previous Topic: Procedure cursor For loop don't execute
Next Topic: Dynamic Rows to Column
Goto Forum:
  


Current Time: Sat Aug 09 00:23:21 CDT 2025