Dbms_metadata.get_ddl and select_catalog_role

Question

Hi,
We have been requested to give support staff the ability to see table triggers, stored procedures, etc only for specific schemas and they don't have access to the schema password. We can't give them SELECT_CATALOG_ROLE because they are not allowed to see all schemas. I wish there were a way to grant a version of SELECT_CATALOG_ROLE for only certain schemas......
I've played around with dbms_metadata.get_ddl with no luck (as per the documentation, but just had to try it anyway). I've even considered the script below, but it requires creating a view under the SYS schema and I can't figure out how to add triggers to the view.
Any ideas would be greatly appreciated!
Thanks,
Susan
accept 1 prompt "Enter Owner:"
create or replace view all_dev_source
(OWNER, NAME, TYPE, LINE, TEXT)
as
select u.name, o.name,
decode(o.type#, 7, 'PROCEDURE', 8, 'FUNCTION', 9, 'PACKAGE',
11, 'PACKAGE BODY', 13, 'TYPE', 14, 'TYPE BODY',
'UNDEFINED'),
s.line, s.source
from sys.obj$ o, sys.source$ s, sys.user$ u
where
u.name = upper('&&1') and
o.obj# = s.obj#
and o.owner# = u.user#
and o.type# in (7, 8, 9, 11, 13, 14)
and
o.owner# in (userenv('SCHEMAID'), 1 /* PUBLIC */)
or
(o.type# = 7 or o.type# = 8 or o.type# = 9)
and
o.obj# in (select obj# from sys.objauth$
where grantee# in (select kzsrorol from x$kzsro)
and privilege# = 12 /* EXECUTE */)
or
exists
select null from sys.sysauth$
where grantee# in (select kzsrorol from x$kzsro)
and
/* procedure */
(o.type# = 7 or o.type# = 8 or o.type# = 9)
or
privilege# = -144 /* EXECUTE ANY PROCEDURE */
or
privilege# = -141 /* CREATE ANY PROCEDURE */
     or
/* package body */
o.type# = 11 or
privilege# = -141 /* CREATE ANY PROCEDURE */
or
/* type */
o.type# = 13
or
privilege# = -184 /* EXECUTE ANY TYPE */
or
privilege# = -181 /* CREATE ANY TYPE */
     or
/* type body */
o.type# = 14 and
privilege# = -181 /* CREATE ANY TYPE */
union
select u.name, o.name, 'JAVA SOURCE', s.joxftlno, s.joxftsrc
from sys.obj$ o, x$joxfs s, sys.user$ u
where
u.name = upper('&&1') and
o.obj# = s.joxftobn
and o.owner# = u.user#
and o.type# = 28
and
o.owner# in (userenv('SCHEMAID'), 1 /* PUBLIC */)
or
o.obj# in (select obj# from sys.objauth$
where grantee# in (select kzsrorol from x$kzsro)
and privilege# = 12 /* EXECUTE */)
or
exists
select null from sys.sysauth$
where grantee# in (select kzsrorol from x$kzsro)
and
/* procedure */
privilege# = -144 /* EXECUTE ANY PROCEDURE */
or
privilege# = -141 /* CREATE ANY PROCEDURE */
comment on table all_dev_source is
'Current source on stored objects that user is allowed to create'
comment on column all_dev_source.OWNER is
'Owner of the object'
comment on column all_dev_source.NAME is
'Name of the object'
comment on column all_dev_source.TYPE is
'Type of the object: "TYPE", "TYPE BODY", "PROCEDURE", "FUNCTION",
"PACKAGE", "PACKAGE BODY" or "JAVA SOURCE"'
comment on column all_dev_source.LINE is
'Line number of this line of source'
comment on column all_dev_source.TEXT is
'Source text'
grant select on all_dev_source to <username>
/

Answer 1

user632322 wrote:
I think I am misunderstanding your reply becauseI had to be more specific. By "privileged user" I meant SYS. SELECT_CATALOG_ROLE is a role itself, so it will be ignored by definer rights SP/SF. That is why it has to be owned by privileged user SYS:
SQL> select * from v$version
  2  /
BANNER
Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - Prod
PL/SQL Release 10.2.0.4.0 - Production
CORE    10.2.0.4.0      Production
TNS for 32-bit Windows: Version 10.2.0.4.0 - Production
NLSRTL Version 10.2.0.4.0 - Production
SQL> show user
USER is "SYS"
SQL> create user u1 identified by u1 default tablespace users quota unlimited on users
  2  /
User created.
SQL> grant create session to u1
  2  /
Grant succeeded.
SQL> create or replace
  2    function get_ddl(
  3                     p_type varchar2,
  4                     p_object varchar2,
  5                     p_owner varchar2
  6                    )
  7      return clob
  8      is
  9      begin
10          return dbms_metadata.get_ddl(p_type,p_object,p_owner);
11  end;
12  /
Function created.
SQL> grant execute on get_ddl to u1
  2  /
Grant succeeded.
SQL> connect u1/u1
Connected.
SQL> set serveroutput on
SQL> exec dbms_output.put_line(dbms_metadata.get_ddl('TABLE','EMP','SCOTT'));
BEGIN dbms_output.put_line(dbms_metadata.get_ddl('TABLE','EMP','SCOTT')); END;
ERROR at line 1:
ORA-31603: object "EMP" of type TABLE not found in schema "SCOTT"
ORA-06512: at "SYS.DBMS_SYS_ERROR", line 105
ORA-06512: at "SYS.DBMS_METADATA", line 2806
ORA-06512: at "SYS.DBMS_METADATA", line 4333
ORA-06512: at line 1
SQL> exec dbms_output.put_line(sys.get_ddl('TABLE','EMP','SCOTT'));
  CREATE TABLE "SCOTT"."EMP"
   (    "EMPNO" NUMBER(4,0),
        "ENAME" VARCHAR2(10),
        "JOB" VARCHAR2(9),
        "MGR" NUMBER(4,0),
        "HIREDATE" DATE,
        "SAL"
NUMBER(7,2),
        "COMM" NUMBER(7,2),
        "DEPTNO" NUMBER(2,0),
         CONSTRAINT
"PK_EMP" PRIMARY KEY ("EMPNO")
  USING INDEX PCTFREE 10 INITRANS 2 MAXTRANS 255
COMPUTE STATISTICS
  STORAGE(INITIAL 65536 NEXT 1048576 MINEXTENTS 1 MAXEXTENTS
2147483645
  PCTINCREASE 0 FREELISTS 1 FREELIST GROUPS 1 BUFFER_POOL DEFAULT)
TABLESPACE "USERS"  ENABLE,
         CONSTRAINT "FK_DEPTNO" FOREIGN KEY ("DEPTNO")
REFERENCES "SCOTT"."DEPT" ("DEPTNO") ENABLE
   ) PCTFREE 10 PCTUSED 40 INITRANS
1 MAXTRANS 255 NOCOMPRESS LOGGING
  STORAGE(INITIAL 65536 NEXT 1048576
MINEXTENTS 1 MAXEXTENTS 2147483645
  PCTINCREASE 0 FREELISTS 1 FREELIST GROUPS 1
BUFFER_POOL DEFAULT)
  TABLESPACE "USERS"
PL/SQL procedure successfully completed.
SQL> Now one more correction to my previous reply. Driver table shoudl not be owned by SYS (that would be bad practice). Create it in some other schema. Just make sure your "support staff" has no access to it.
SY.