FAQ
Hello all, I detected a problem as described by testcase: (tested in
following Installations) Linux x86 64-bit - Oracle Database 11g Enterprise
Edition Release 11.2.0.3.0 - 64bit Production Microsoft Windows x86 64-bit -
Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64bit Production
Linux IA (32-bit) - Oracle Database 11g Enterprise Edition Release
11.2.0.3.0- Production The problem did not occure on 11.2.0.2 or previous
Testcase: create user ttt_user identified by asdfghjk; grant create session
to ttt_user; grant execute on dbms_output to ttt_user with grant option;
create user ttt2_user identified by asdfghjk; connect ttt_user/asdfghjk --
execute privilege is there exec dbms_output.enable -- but grant option is
missed grant execute on sys.dbms_output to ttt2_user; *
ERROR at line 1: ORA-01031: insufficient privileges This problem did not
occure with select privilege on a sys table. It also did not occure with
execute privilege on a user package. We use this feature for a special admin
user in a software system with tenant isolation where the isolation is done
by using separate databse schemas for each tenant. The admin user is there
tocreate new tenants (a very complex installation proedure) and need to
granta couple of execute privileges on sys pacakges. Does anyone heard of
this problem ? Is there any mechanism to fall back to previous fucntrional
behaviour - i. e. seting a hidden parameter, setting a special event etc. ?
(I`m argueing the ignoring of the grant option with execute privilege on sys
objects is a work around due to a security problem occured later) TIA kf

Search Discussions

  • Kurt-franke at Feb 21, 2012 at 7:26 pm
    Yes, the creation of the users and the grants are done connected with sys as sysdba

    kf


    -----Ursprüngliche Nachricht-----
    Von: "Michael Dinh" <mdinh@XIFIN.Com>
    Gesendet: 21.02.2012 17:44:34
    An: "'Kurt-Franke@web.de'" <Kurt-Franke@web.de>, oracle-l <oracle-l@freelists.org>
    Betreff: RE: granting sys objects with grant option in 11.2.0.3 the grant option has no effect
    Were you connected as SYS when executing - grant execute on dbms_output to ttt_user with grant option; ???

    Michael Dinh
    Disparity Breaks Automation (DBA)

    Great minds discuss ideas; average minds discuss events; small minds discuss people - Eleanor Roosevelt
    Confidence comes not from always being right but from not fearing to be wrong - Peter T Mcintyre


    -----Original Message-----
    From: oracle-l-bounce@freelists.org On Behalf Of Kurt-Franke@web.de
    Sent: Tuesday, February 21, 2012 6:31 AM
    To: oracle-l
    Cc: Kurt.Franke@cellent-fs.de; Ronald.Stiefel@cellent-fs.de
    Subject: FW: granting sys objects with grant option in 11.2.0.3 the grant option has no effect
    ...
  • Michael Dinh at Feb 21, 2012 at 7:28 pm
    I am seeing the same issue for Solaris.
    sysdba
    SQL*Plus: Release 11.2.0.3.0 Production on Tue Feb 21 08:57:42 2012

    Copyright (c) 1982, 2011, Oracle. All rights reserved.


    Connected to:
    Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64bit Production
    With the Partitioning option

    SYS@oracle> create user ttt_user identified by asdfghjk;

    User created.

    SYS@oracle> grant create session to ttt_user;

    Grant succeeded.

    SYS@oracle> grant execute on dbms_output to ttt_user with grant option;

    Grant succeeded.

    SYS@oracle> create user ttt2_user identified by asdfghjk;

    User created.

    SYS@oracle> connect ttt_user/asdfghjk
    Connected.
    TTT_USER@oracle> exec dbms_output.enable;

    PL/SQL procedure successfully completed.

    TTT_USER@oracle> grant execute on sys.dbms_output to ttt2_user;
    grant execute on sys.dbms_output to ttt2_user
    *
    ERROR at line 1:
    ORA-01031: insufficient privileges



    Michael Dinh
    Disparity Breaks Automation (DBA)

    Great minds discuss ideas; average minds discuss events; small minds discuss people - Eleanor Roosevelt
    Confidence comes not from always being right but from not fearing to be wrong - Peter T Mcintyre


    -----Original Message-----
    From: Kurt-Franke@web.de
    Sent: Tuesday, February 21, 2012 8:53 AM
    To: Michael Dinh; oracle-l
    Cc: Kurt.Franke@cellent-fs.de; Ronald.Stiefel@cellent-fs.de
    Subject: Re: granting sys objects with grant option in 11.2.0.3 the grant option has no effect



    Yes, the creation of the users and the grants are done connected with sys as sysdba

    kf


    -----Ursprüngliche Nachricht-----
    Von: "Michael Dinh" <mdinh@XIFIN.Com>
    Gesendet: 21.02.2012 17:44:34
    An: "'Kurt-Franke@web.de'" <Kurt-Franke@web.de>, oracle-l <oracle-l@freelists.org>
    Betreff: RE: granting sys objects with grant option in 11.2.0.3 the grant option has no effect
    Were you connected as SYS when executing - grant execute on dbms_output to ttt_user with grant option; ???

    Michael Dinh
    Disparity Breaks Automation (DBA)

    Great minds discuss ideas; average minds discuss events; small minds discuss people - Eleanor Roosevelt
    Confidence comes not from always being right but from not fearing to be wrong - Peter T Mcintyre


    -----Original Message-----
    From: oracle-l-bounce@freelists.org On Behalf Of Kurt-Franke@web.de
    Sent: Tuesday, February 21, 2012 6:31 AM
    To: oracle-l
    Cc: Kurt.Franke@cellent-fs.de; Ronald.Stiefel@cellent-fs.de
    Subject: FW: granting sys objects with grant option in 11.2.0.3 the grant option has no effect
    ...
  • Rjamya at Feb 21, 2012 at 8:30 pm
    Bug 13036331<https://supporthtml.oracle.com/epmos/faces/ui/km/BugDisplay.jspx?id=13036331>ORA-01031
    INSUFFICIENT PRIVILEGES WHEN GRANTING EXECUTE ON DBMS PACKAGES
    On Tue, Feb 21, 2012 at 11:53 AM, wrote:

    Yes, the creation of the users and the grants are done connected with sys
    as sysdba

    kf

    --
    http://www.freelists.org/webpage/oracle-l
  • Kurt-franke at Feb 22, 2012 at 11:32 am
    Thanks, the Patch solved the problem.

    best regards

    kf


    -----Ursprüngliche Nachricht-----
    Von: rjamya <rjamya@gmail.com>
    Gesendet: 21.02.2012 20:36:42
    An: Kurt-Franke@web.de
    Betreff: Re: granting sys objects with grant option in 11.2.0.3 the grant option has no effect
    Bug 13036331<https://supporthtml.oracle.com/epmos/faces/ui/km/BugDisplay.jspx?id=13036331>ORA-01031
    INSUFFICIENT PRIVILEGES WHEN GRANTING EXECUTE ON DBMS PACKAGES
    On Tue, Feb 21, 2012 at 11:53 AM, wrote:

    Yes, the creation of the users and the grants are done connected with sys
    as sysdba

    kf

    --
    http://www.freelists.org/webpage/oracle-l
    --
    http://www.freelists.org/webpage/oracle-l

Related Discussions

Discussion Navigation
viewthread | post
Discussion Overview
grouporacle-l @
categoriesoracle
postedFeb 21, '12 at 2:09p
activeFeb 22, '12 at 11:32a
posts5
users3
websiteoracle.com

People

Translate

site design / logo © 2022 Grokbase