Skip to Main Content

SQL & PL/SQL

Announcement

For appeals, questions and feedback about Oracle Forums, please email oracle-forums-moderators_us@oracle.com. Technical questions should be asked in the appropriate category. Thank you!

INHERIT PRIVILEGES - purpose

PS_orclNerdNov 21 2016 — edited Nov 21 2016

Hi,

I am trying to understand the purpose of grant INHERIT PRIVILEGES on user tomas to peter ;

Based on this testcase, it's straight forward that if I build something and grant necessary privileges, it will work.. I have read already the documentation, but it's written in a language I don't always understand. Well, this little example does everything what an invoker's procedure needs, but at what point I have to define these grants or revokes to control "When a user runs an invoker's rights procedure, Oracle Database checks it to ensure that the procedure owner has either the INHERIT PRIVILEGES privilege on the invoking user, or if the owner has been granted the INHERIT ANY PRIVILEGES privilege. If the privilege check fails, then Oracle Database returns an ORA-06598: insufficient INHERIT PRIVILEGES privilege error."

https://docs.oracle.com/database/121/DBSEG/dr_ir.htm#DBSEG660

connect / as sysdba

create tablespace test ;

create user peter identified by peter default tablespace test quota unlimited on test ;

grant connect, resource to peter ;

create user tomas identified by tomas default tablespace test quota unlimited on test ;

grant create session,create table to tomas ;

connect peter/peter

create table test (id varchar2(100)) ;

insert into test values ('Works') ;

commit ;

create or replace procedure showuser1 authid definer as

v_syscontext varchar2(1000) ;

v_value varchar2(100) ;

begin

select sys_context('USERENV','CURRENT_USER') into v_syscontext from dual ;

dbms_output.put_line(v_syscontext);

select id into v_value from test ;

dbms_output.put_line(v_value) ;

end;

/

create or replace procedure showuser2 authid current_user as

v_syscontext varchar2(1000) ;

v_value varchar2(100) ;

begin

select sys_context('USERENV','CURRENT_USER') into v_syscontext from dual ;

dbms_output.put_line(v_syscontext);

select id into v_value from test ;

dbms_output.put_line(v_value) ;

end;

/

grant execute on showuser1 to tomas ;

grant execute on showuser2 to tomas ;

connect tomas/tomas

create table test (id varchar2(100)) ;

insert into test values ('Yeaah') ;

commit ;

TOMAS> exec peter.showuser1

PETER

Works

TOMAS> exec peter.showuser2

TOMAS

Yeaah

TOMAS> connect peter/peter

Connected.

PETER> create or replace procedure showuser2 authid current_user as

v_syscontext varchar2(1000) ;

v_value varchar2(100) ;

begin

select sys_context('USERENV','CURRENT_USER') into v_syscontext from dual ;

dbms_output.put_line(v_syscontext);

select id into v_value from test ;

dbms_output.put_line(v_value) ;

/* I am an evil developer, haha */

delete from test ;

insert into test values ('hacked') ;

commit ;

end;

/

Procedure created.

PETER> connect tomas/tomas

Connected.

TOMAS>

TOMAS> exec peter.showuser1

PETER

Works

PL/SQL procedure successfully completed.

TOMAS> exec peter.showuser2

TOMAS

Yeaah

PL/SQL procedure successfully completed.

TOMAS> exec peter.showuser2

TOMAS

hacked

PL/SQL procedure successfully completed.

This post has been answered by Solomon Yakobson on Nov 21 2016
Jump to Answer
Comments
Locked Post
New comments cannot be posted to this locked post.
Post Details
Locked on Dec 19 2016
Added on Nov 21 2016
6 comments
5,262 views