ACL denied using Pkb but works using anonymous block with same user

Question

I have a recent 11g installation with a developer that is getting a access denied message when using a package but is able to run the same code manually in sqlplus and it works.
eg. I have granted access to connect and resolve to the user BLAH.
from sqlplus, BLAH can do
select trim(substr(utl_inaddr.get_host_name,1,30)) from dual;
TRIM(SUBSTR(UTL_INADDR.GET_HOST_NAME,1,30))
serverhostname
and get the hostname successfully, but this same line in a pkb fails when called like so
exec func_name.something()
BEGIN func_name.something(); END;
ERROR at line 1:
ORA-24247: network access denied by access control list (ACL)
ORA-06512: at "SYS.UTL_INADDR", line 4
ORA-06512: at "SYS.UTL_INADDR", line 35
ORA-06512: at line 1
ORA-06512: at "BLAH.FUNC_NAME", line 83
ORA-06512: at line 1
but if you were to do this same bit of code in sqlplus as follows:
set serveroutput on
declare
mhost varchar(30);
begin
select trim(substr(utl_inaddr.get_host_name,1,30)) into mhost
from dual;
dbms_output.put_line(mhost);
end;
it works.
I do not understand this at all. This is the same user account that owns the pkb and is running it in sqlplus. The user has been granted the connect and resolve priv through being granted a role that has this permission.
Can anyone help me out here?

Answer 1

Thanks, the oracle logic behind this doesn't make sense to me - if the user can do this action, then surely the user should be able to run the package...
Anyway, I will try to grant directly to the user that needs the privs, but then how do I grant this privilege to multiple users, it's some awkward bit of pl/sql just to grant it to one user.
Here is what I did:
dbms_network_acl_admin.create_acl(acl => 'filename.xml',
description => 'Network permissions for BLAH_USER to connect/resolve any host',
principal => 'BLAH_USER', is_grant => TRUE, privilege => 'connect');
dbms_network_acl_admin.add_privilege(acl => 'filename.xml', principal => 'BLAH_USER', is_grant => TRUE, privilege => 'resolve');
dbms_network_acl_admin.assign_acl(acl => 'filename.xml', host => '*');
grant execute on dbms_network_acl_admin to BLAH_USER;
but this only works for 1 user and I cannot recreate this as the acl now already exists. Would I have to change filename.xml every time and do all these steps for every user?
This is why I granted to a role and then granted that role to the BLAH_USER originally.
Any ideas on how to make this scalable to many users or to add users to this ACL?