Grant Access on .sys owned objects...?

Question

For example purposes, say I need to grant 'Select' to DBA_Users to a role, how is this possible? I'm looking to grant this explicitly and not thru select any dictionary.
Do I need to run the grant statement from the SYS ID? As I have the grant any priv and any obj priv, it seems that will not suffice....
Thanks!

Answer 1

One way to do this is to create a stored procedure owned by a privileged user which has the right to grant the needed privilege. You only need to grant EXECUTE privilege on this procedure to the admin team.
In this example, owner is OPS$ORACLE and admin. user is NEW.
The procedure should make some additional checks according to your security rules.
SQL> show user
USER is "SYS"
SQL> grant select on dba_users to ops$oracle with grant option;
Grant succeeded.
SQL> connect  /
Connected.
SQL> show user
USER is "OPS$ORACLE"
SQL> create or replace procedure gs (guser in varchar2)
  2  as
  3  begin
  4  execute immediate 'grant select on sys.dba_users to ' || guser;
  5  end;
  6  /
Procedure created.
SQL> show errors
No errors.
SQL>
SQL> drop user new;
User dropped.
SQL> drop user old;
User dropped.
SQL> create user old identified by old;
User created.
SQL> grant connect to old;
Grant succeeded.
SQL> create user new identified by new;
User created.
SQL> grant connect to new;
Grant succeeded.
SQL> grant execute on gs to new;
Grant succeeded.
SQL>
SQL> connect new/new
Connected.
SQL> exec ops$oracle.gs('OLD');
PL/SQL procedure successfully completed.
SQL>
SQL> connect old/old
Connected.
SQL> select count(*) from dba_users;
  COUNT(*)
     33Edited by: P. Forstmann on May 27, 2009 10:21 PM