Re: Security problem calling C external procedure

One thing that could be done is to make the extproc executable setuid to some other user. That would ensure that you are running as a user other than the oracle user.

However, please do not make it setuid to root as (obviously) extproc would then be able to execute any command.

"Sergei Gouskov" <sgouskov_at_ue.com.au> writes:

> Helllo,
> From plsql I call C function as external procedure (shared library on unix),
> I found that this function got all access permitions that user oracle
> has...and this of course invoked strong objections from DBA team leader :)
> now, I wonder if you people deal with such an issue before? what choices do
> I have?
>
> rgds, Sergei Gouskov
>
>
>
>
>
 

-- 
                                Thanks,
                                Rick
                                Rick Wessman
                                Server Security Group
                                Oracle Corporation
                                Rick.Wessman_at_oracle.com

     The opinions expressed above are mine and do not necessarily reflect
                         those of Oracle Corporation.