question of privilege object

Hi, the oracle documentation says:

A user automatically has all the privileges object for the schema contained in its own schema objects. A user can grant a privilege object on any schema object, that he or she belongs to another user or role. A user with the GRANT ANY OBJECT privilege can grant or revoke privileges specified object to another user with or without the GRANT option of the GRANT statement. Otherwise, the recipient can use the privilege, but may be granted to other users.

For example, suppose that the user SCOTT has a table named t2:
SQL>GRANT grant any object privilege TO U1; 
SQL> connect u1/u1 
Connected. 
SQL> GRANT select on scott.t2 \TO U2; 
SQL> SELECT GRANTEE, OWNER, GRANTOR, PRIVILEGE, GRANTABLE FROM DBA_TAB_PRIVS 
 WHERE TABLE_NAME = 'employees'; 

GRANTEE                        OWNER                                GRANTOR                        PRIVILEGE                            GRA 
------------------------------ ------------------------------ ------------------------------ ----------------------------------------  --- 
U2                             SCOTT                              SCOTT                          SELECT                                NO
Now this confuses me. Surely it's U1, who is the grantor and not Scott, no?

Oracleguy,

I don't have you your point, but I guess that right reason if only that although the U1 user has not had the privilege and he could grant only because of the Grant Any Object private, it is not represented as the grantor, but Scott doesn't!

[oracle@edhdr1p0-prod sqlplus]$ sqlplus / as sysdba

SQL*Plus: Release 11.2.0.1.0 Production on Thu Feb 18 09:19:39 2010

Copyright (c) 1982, 2009, Oracle.  All rights reserved.

Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options

SQL> create user u1 identified by u1;

User created.

SQL> grant create session, create table to u1;

Grant succeeded.

SQL> conn u1/u1
Connected.
SQL> select * from tab;

no rows selected

SQL> conn scott/tiger
Connected.
SQL> create table t2( a number);

Table created.

SQL> conn  / as sysdba
Connected.
SQL> grant grant any object privilege to u1;

Grant succeeded.

SQL> conn u1/u1
Connected.

SQL> select * from scott.t2
  2  ;
select * from scott.t2
                    *
ERROR at line 1:
ORA-01031: insufficient privileges

SQL> grant select on scott.t2 to system;

Grant succeeded.

SQL> conn / as sysdba
Connected.

SQL>  SELECT GRANTEE, OWNER, GRANTOR, PRIVILEGE, GRANTABLE FROM DBA_TAB_PRIVS
 WHERE TABLE_NAME = 'T2';
 WHERE TABLE_N 'T2'
               *
ERROR at line 2:
ORA-00920: invalid relational operator

SQL> SELECT GRANTEE, OWNER, GRANTOR, PRIVILEGE, GRANTABLE FROM DBA_TAB_PRIVS
  2  where table_name='T2';

GRANTEE                        OWNER
------------------------------ ------------------------------
GRANTOR                        PRIVILEGE                                GRA
------------------------------ ---------------------------------------- ---
SYSTEM                         SCOTT
SCOTT                          SELECT                                   NO

SQL> 

Now, when I explicitly give the priv to U1 and it gives him, he is shown as the beneficiary

Sorry, I did not know that its still only Scott who is shown in both places.

USER is "SYS"
SQL> grant select on scott.t2 to U1;

Grant succeeded.

SQL> conn u1/u1
Connected.
SQL> grant select on scott.t2 to system;

Grant succeeded.

SQL> conn / as sysdba
Connected.
SQL> SELECT GRANTEE, OWNER, GRANTOR, PRIVILEGE, GRANTABLE FROM DBA_TAB_PRIVS
 WHERE TABLE_NAME = 'T2';   2  

GRANTEE                        OWNER
------------------------------ ------------------------------
GRANTOR                        PRIVILEGE                                GRA
------------------------------ ---------------------------------------- ---
SYSTEM                         SCOTT
SCOTT                          SELECT                                   NO

U1                             SCOTT
SCOTT                          SELECT                                   NO

SQL> 

Update:

Oracleguy,
That's what I found on this priv to docs,
http://download.Oracle.com/docs/CD/E11882_01/server.112/e10592/statements_9013.htm#i2077938

GRANT ANY OBJECT PRIVILEGE
     Grant any object privilege that the object owner is permitted to grant.

So I guess it must explain what is shown in the view. Given that the owner is Scott who is authorized to grant the privilege, the name which is given here since its his privilege that is passed to the second user. -What looks like a reasonable explanation?
HTH
Aman...

Published by: Aman... on February 18, 2010 09:36

Published by: update added Aman... February 18, 2010 11:55

Tags: Database

Similar Questions

  • Questions of privilege.

    Hi all

    Yesterday we had to change the name of a role. Since there is no option to rename the role, I had to create another and older had to grant the same privileges as the role.

    Very well, once I created the new role, I have granted to all users who have the older role. Today a user told me that was trying to perform the procedure, and an error was shown "insuffient privileges" on line 61.

    This line (61) is a select statement. His role has the following privileges:
    Select any table, execute any procedure, change any procedure, create any procedure.

    I asked him to try to run the following select statement separately and it worked.
    Then I asked him to perform the procedure, he continues to display the error.

    So I decided to give him privileges object on this table. Then, it worked.

    Really, I don't know what could happen, someone at - he spent for this situation before?

    Thanks in advance.

    BSalesRashid wrote:
    Hi all

    Yesterday we had to change the name of a role. Since there is no option to rename the role, I had to create another and older had to grant the same privileges as the role.

    Very well, once I created the new role, I have granted to all users who have the older role. Today a user told me that was trying to perform the procedure, and an error was shown "insuffient privileges" on line 61.

    This line (61) is a select statement. His role has the following privileges:
    Select any table, execute any procedure, change any procedure, create any procedure.

    I asked him to try to run the following select statement separately and it worked.
    Then I asked him to perform the procedure, he continues to display the error.

    So I decided to give him privileges object on this table. Then, it worked.

    Really, I don't know what could happen, someone at - he spent for this situation before?

    Thanks in advance.

    acquired through ROLE privileges do not apply in the PL/SQL procedure named

  • Question of privileges...

    Hi all..


    Please help me with this question of privileges.

    Let's say that ""(schéma/utilisateur) User1 has a package "package1" that updates and inserts data into 'user1 tables' "»

    Now, if I "User2 (schema/user)" who has run privileged on user1.package.User2 has no any reply on the tables of user1.

    User2 can still run the package user1? (user2 has execute privilege on the package of user1 but doen't have)
    access the tables of user1)

    Thanks in advance...

    Hello

    Marella Phani wrote:
    Hi all..

    Please help me with this question of privileges.

    Let's say that ""(schéma/utilisateur) User1 has a package "package1" that updates and inserts data into 'user1 tables' "»

    Whenever you have any questions, please post whatever one needs to re - create the rpoblem and test their ideas. In this case, which includes a package (spec and body) and all tables that package references. Simplify as much as possible... You can probably do it with 20 lines of code.

    Now, if I "User2 (schema/user)" who has run privileged on user1.package.User2 has no any reply on the tables of user1.

    User2 can still run the package user1? (user2 has execute privilege on the package of user1 but doen't have)
    access the tables of user1)

    Yes, but don't take my word for it. Try it and see.
    This assumes that package1 is created with the default AUTHID DEFINE.

  • questions of privilege properties addToolButton

    Hello

    I am trying to add a button of toolbar with a JavaScript script to the folder level and I have a few questions of privilege.

    I want the button to be an icon. But to open a doc to import the image I need a privileged context. The button must also be like a power button, which remains marked when you press once and becomes unmarked when you press new. Therefore, what I tried... but unfortunately does not work. Even if I set global.isBankStatement false at the beginning as the key is marked. I also tried to set cMarked: false and 'false', but always the button is marked. Only when I omit the property of cMarked, it is not enabled.

    Any hint is appreciated ;-)

    (I work with Windows Vista and Acrobat 9 Pro)

    global.isBankStatement = false;

    icon var = {app.trustedFunction (function ()}
    app.beginPriv ();
    myDoc var = app.newDoc ();
    myDoc.importIcon ("myIcon", "/ C/acrobat_images/bank_20x20.gif", 0);
    var oIcon = util.iconStreamFromIcon (myDoc.getIcon ("myIcon"));
    myDoc.closeDoc (true);
    Return oIcon;
    });

    marked var = {app.trustedFunction (function ()}
    app.beginPriv ();
    var result = global.isBankStatement;
    app.endPriv ();
    return the result;
    });


    app.addToolButton({)
    cName: "myToolButton."
    oIcon: "icon."
    cExec: "handleBankStatements()."
    cTooltext: "bank statement."
    cEnable: «event.rc = (app.doc!» (= null)",
    NPO: 1,
    cMarked: 'event.rc = marked. "
    });

    Don't know if it is the cause of the problem, but since marked is a function you must call it as follows:

    marked()

  • Question of privilege and bluetooth satellite L650 Admin

    Hello

    (1) I have single user in my windows 7 (show administrator), but when try to open Task Manager or regedit it displays as u is not a permit to the admin to do it, when I invited acc, it allow him given the Task Manager and other options.
    I tried with > net user administrator enable option in the Task Manager as admin (default windows admin) is not available...
    How to solve this problem?

    (2) in my Bluetooth I receive the files of others using this, but I am not able to send the file to anyone.
    Why this is happening and how to check it?

    2 weeks before that I installed avira free edition it will affect anything?

    Thanks in advance...

    > 1) I have single user in my windows 7 (show administrator), but when try to open Task Manager or regedit it displays as u is not a permit to the admin to do it, when I activate comments VAC, it give the Task Manager and other options, I tried with > net user administrator activate the option in the Task Manager as admin (default windows admin) is not available... How to solve this problem?

    First I put t think its a laptop problem. It s question OS.
    I don't know why a marked admin user can not get administrator privileges, but have you tested this creating a new user on this laptop of m? If this is not the case, try this.

    In addition, I would recommend activation of the hidden Admin account.
    Go to CMD (command prompt) and try this:

    + net user administrator / active: yes +.

    Then a message should appear that this command was run sucefully.
    Sign up now and you will see the Admin account
    Now you can connect using this account and can create a new user with administrator privileges

  • HP impossible to scan - Scan question of privilege? -other working tools

    O/s - Yosemite OS X 10.10.1

    Subsequently by (re-setup of HP scanning documents):

    http://h30434.www3.HP.com/T5/scanning-faxing-and-copying/where-can-I-download-HP-scan-for-Mac/m-p/48...

    Question:

    Having confirmed that the printer/scanner is available and successfully launched a digitization using webscan (interface web, present during the INVESTIGATION period announced for the printer/scanner). I then try the same using HP Scan and the message

    Scan reported an error: HP ENVY 110 series is currently unavailable. Please check if it is connected and turned on, or try again later.

    Summary:

    Scan worked and stopped working at some point in the past. I'm not clear what has changed, so it is a scratch survey 'from '.

    • I have re-installed HP Scan and configure access to the associated with the printer/scanner bonjour service. See the description of the above question.

    Issues related to the:

    1. Are there log files, I can access to find additional details about the error?
    2. Are there controls of privilege or configurations of parameters / I'm absent for HP Scan have the required access?
    3. Can what additional steps I take to confirm the cause of the problem?

    Thanks in advance.

    Hi @mathewbutler

    I can't say I have all the answers to your questions, but I have an idea as to what we can try to fix it!

    I suggest to uninstall and reinstall the software. Please follow the instructions below to complete a more comprehensive uninstall than basic uninstall.

    Scrub / uninstall

    • Open the Applications folder > folder HP or Hewlett Packard > Uninstall HP
    • Click continue, click on one of the printers in the list.
    • * Only perform this step if you have not all other HP printers.  Press and hold the Option, control and command, while now the three buttons.
    • Click Uninstall.

    Reset the printing system

    1. Click on the Apple icon ( ), then click on System Preferences.
  • Installation Question about privileges user/role

    OK, I am new to Oracle, (well I last worked with him when he was 8i).

    (1) I have a database with a tablespace that contains the replicated data form another source and I want to create a role that has select permissions on the tables.

    What I've already put in place. I created a role with the role CONNECT and privileges select object on all tables of this user (users that are replicated to the database tables). It works, the role can execute select statements out of these data.

    (2) I want this part (or at least users with this role created) in order to create the tables/views/etc, (in other words for development rights) without giving them all change the rights on the objects mentioned in part 1. I don't know how to proceed.


    Thanks for any help you can provide.

    What version of Oracle?
    The CONNECT role should not serve on 11 GR 2, in my opinion, that it has been reduced to what the only privilege of create session. Oracle also recommends not to use the role of RESOURCES more.

    I think that you would give the special role created for developers only those system privileges they need, such as create table, create the sequence, create procedure, etc...

    This will allow them to create objects under their own username but no other objects (except the public) users will otherwise you do not explicitly add the role.

    Avoid to grant privileges such as create any table.

    HTH - Mark D Powell.

  • question of privileges to roles

    Version Info: Oracle version 11 g 2 running on windows server 2008.

    I have a question about something I did not understand in terms of a role.

    I have a table named abc belonging to a schema called MainSchema. I created a role in the scheme called updateweb which has a privilege to update the table of the CBA.
    grant update on MainSchema.abc to updateweb; 
    I have the privilege of update on the above role to another schema called Internet users.
     grant updateweb to webusers; 
    However when I run an update statement on behalf of the users on the abc table schema, asp.net Web page, I get an ora-1031 not sufficient privileges.


    However if I grant it directly like that
    grant update on mainschema.abc to webusers;         
    (from mainschema), it works.

    Why it does not work when you use leave a role?

    Thank you.

    Hmm... even if it is a simple sql statement update? (not a pl/sql statement)

    Restrictions apply to each SQL; including SELECT

  • question of shared objects...

    I create a kiosk with room for comments from visitors.  There are several sections to the kiosk each with their own standalone .swf file (not browser based; no html).  I plan on the use of shared objects to collect the entrance of visitors in each section and these will be periodically reviewed by the staff of the Museum before actually posting.  My question is, can I create a .swf to the staff of the Museum that uses a table to examine each of the SO created by the different sections or will a flash read ONLY in a SharedObject file, forcing me to create a separate application for each section for the staff of the Museum?

    Thank you!

    It depends on how you define your so if they are defined with the more permissive setting ("/"), you can use a swf to load all the so

  • Question about privilege SYSDBA

    Good evening

    I noticed that all the users in my database can connect you as 'sysdba' oracle host, (which surprises me) but cannot connect as 'sysdba' from a client connected to the host (who is as expected).

    Question: Why users who have never been granted the privilege of 'sysdba' would be able to connect as sysdba from the oracle host?

    Thank you for your help,

    John.

    PS: I use Windows XP Pro SP2 to host and client.

    Published by: 440bx - 11 GR 2 on August 22, 2010 21:27 - added platform

    No idea why?

    It has NOTHING to do with the Oracle schema name!
    It has everything to do with the OS user calling sqlplus!

    If you create a new/different OS user & then log on to the OS using the new user of the OS.
    This new OS user won't even be able to invoke sqlplus and NOT allowed in the DB "as sysdba.

  • Question about l ' object net.rim.device.api.ui.Screen

    Hello world

    I have a class that accepts an object of type "Screen" (net.rim.device.api.ui.Screen) in its constructor. When I instantiate this class, I include a class that extends the screen as a parameter. For example:

    public ClassA extends MainScreen {
         public void tester(){
              ClassB classB = new ClassB(this);
         }
              public void sampleMethod(){        ...     }}
    
    public ClassB {
    
         Screen screen;
    
         public ClassB(Screen screen) {
              this.screen = screen;
         }
         public doStuff(){          screen.sampleMethod();     }}
    

    My problem is that ClassB calls methods that are placed, but unless I change type "Screen" in the "class A", I receive the error: "the sampleMethod() method is not defined for the type of screen.

    How can I me ClassB to accept different classes that extend screen?

    Thank you!

    "each screen implements a SampleMethod() interface.

    Then could ClassB looks like this?

    public ClassB {}

    SampleMethodInterface screen;

    public ClassB (form SampleMethodInterface) {}
    This.screen = screen;
    }

    public doStuff() {}
    screen.sampleMethod ();
    }
    }

  • Question about oracle objects

    Hi people

    I came across the below example on the oracle documentation.

    I'm not quite sure why "emp is NULL #2' always get printed even if the Member attribute is assigned a value that should be non-NULL and" ""emp is NULL #3"isn't even after printing has been assigned to the object with a NULL value."

    Can one of you you please explain about it. or give the overview of the conditions of the NULLable object. Thank you!!

    DECLARE

    EMP employee_typ; -emp is atomically null

    BEGIN

    If emp IS NOTHING THEN DBMS_OUTPUT. Put_line ("emp is NULL #1"); END IF;

    IF emp.employee_id IS NULL THEN

    DBMS_OUTPUT. Put_line ("emp.employee_id is NULL #1");

    END IF;

    EMP.employee_id: = 330;

    If emp IS NOTHING THEN DBMS_OUTPUT. Put_line ("emp is NULL #2"); END IF;

    IF emp.employee_id IS NULL THEN

    DBMS_OUTPUT. Put_line ("emp.employee_id is NULL #2");

    END IF;

    EMP: = employee_typ (NULL, NULL, NULL, NULL,

    NULL, NULL, NULL, NULL, NULL, NULL, NULL,

    address_typ (NULL, NULL, NULL, NULL));

    -emp: = NULL; -It would have made the following statement of the TRUE IF

    If emp IS NOTHING THEN DBMS_OUTPUT. Put_line ("emp is NULL #3"); END IF;

    IF emp.employee_id IS NULL THEN

    DBMS_OUTPUT. Put_line ("emp.employee_id is NULL #3");

    END IF;

    EXCEPTION

    WHEN ACCESS_INTO_NULL THEN

    DBMS_OUTPUT. Put_line ('impossible to assign object NULL value');

    END;

    /

    The result is:


    EMP is NULL #1
    EMP.employee_id is NULL #1
    EMP is NULL #2
    EMP.employee_id is NULL #3

    I came across the below example on the oracle documentation.

    I'm not very sure why 'emp is NULL #2' always get printed even if the Member attribute is assigned a value that should be non-NULL and ' emp is NULL #3 "is not get printed even though the object is assigned to null."

    Can one of you you please explain about it. or give the overview of the conditions of the NULLable object.

    Have you actually tried this example? Why not?

    The best and often faster, learn is to DO - not just read.

    If you tried this example, you would see that you have been "bitten" by a documentation bug.

    EMP.employee_id: = 330;

    That the line of code won't work - it will trigger an exception is the output you get really

    PEM is NULL #1

    EMP.employee_id is NULL #1

    Can't assign value to the NULL object

    PL/SQL procedure successfully completed.

    SQL >

    The 'emp' instance has the value NULL as shows it the first message. If you cannot assign the 330 value him.

    For others, the example seems to be the Oracle documentation

    http://docs.Oracle.com/CD/B19306_01/AppDev.102/b14261/objects.htm#CIHEJIBA

  • Question of privilege table

    Dear Experts,

    I am facing a strange problem:

    I have a table, I was able to check the number of records when you're connected as SYS, but not when you are connected with other IDs (logess). ID "LOGESS" user has select, update privileges on this table

    I am able to do a desc on the table, but cannot verify the number of records. What I'm missing here?

    Published by: Ora DBA on December 11, 2012 12:53 AM

    Perhaps there is a row-level security?

    grant logess; exempt access policy

    and try again.

  • Drag & Drop question (the target object lock)

    Hello

    I worked with an interactive game and I've set up my objects (drag) in a single layer with their target of the object in another. Export Flash 8 AS2 settings (requirement for the site is downloaded to).

    My objects have suddenly to their original position, if they don't land on their target, and I have this job. What I can't get to work is for the object to fit in the box, that I created.

    The object and target have been converted to the clips and the taget received an instance name (targetone) I have used this instance name in the script action that is set on the object. Both target and object have centered their anchor points for X, Y of the purposes.

    Here are my actionscript:

    (press)

    {

    startDrag (this);

    }

    (release)

    {

    stopDrag();

    If (this ._droptarget == "/ targetone")

    {

    This._x=_/targetone._x;

    This._y=_/targetone._y;

    }

    else {}

    This ._x = 319,95;

    This ._y = 138.75;

    }

    }

    He won't just snap into the box. The object is converted into paths (large print) text and the box is also important. I tried to increase it because I thought he might have problems with locking in but nothing works

    Any help would be greatly appreciated!

    Stu

    Thanks for the reply, Ned.

    After a few hours of different script code tests, including your suggestions, I tried to draw an object directly on the stage and it worked.

    I use the boxes which are .ai files and they were imported to the library with layers and effects intact (as separate components). I discovered that the boxes that I designed in Illustrator are too complicated to assign a code to-I guess it's because it has layers.

    I've got around it by drawing a simple box in Flash, by positioning on versions of illustrator and in making it invisible. Problem solved!

    Detective Conan

  • Question of simple objects

    Gidday

    I'm having a brain snap re obtain information about an object:

    var screenArray:Array = Screen.screens;

    var screen_2 = .bounds screenArray [1];

    trace ("Screen 2 limits:" + screen_2);

    gives me...

    Screen 2: (1366 = x, y = 0, l = 800, h = 600)

    Now, I can't crack getting only the property 'w '.  How is that done?

    I thought

    trace ("w:" + screen_2.w);

    But no go and even put the w in various other places.

    Is (x = 1366, y = 0, l = 800, h = 600) even an object, or is it just a string you would have to handle to extract the value of w?

    Thanks for your help.

    According to the documentation, the limits is a Rectangle object, then the properties of a REctangle object are probably what we have to aim to get the values you are after.  For a rectangle, the w would be the width property, so to get the value, you should be able to use...

    trace ("w:" + screen_2.width);

Maybe you are looking for

  • Search in the field address

    Already when I wrote a Word, for example BBC, in the address field, the web site of the BBC opens immediately. Now, it's the list of Google, so I have to click once more.How to solve this problem?

  • Fuze + 8 GB of mem w/32 GB card blocked when 8 GB mem card!

  • UltraDrive battery

    I have a ultradrvie battery which corresponds to my T500. I have a T410 on the way. I'll be able to use this 2nd battery in the T410 also. Thanks in advance!

  • No sound has worked in him went in PD

    I have a Pavilion dv7-6163us Entertainment PC with Windows 7. I started having some problems with it lately, but my main problem is that this morning I listened to her and this afternoon, when I turned it on I have no sound. No internal speakers or h

  • VPN Site to Site and remote access

    I have ASA certified with 25 concurrent VPN connections. I want to know if I have 20 remote tunnels and 5 Site-to-Site created on the same time tunnels, and I want to establish the new Site to the other tunnel, is him Site to Site remove the remote t