Grant execute any function or package

Hi,
Does the below command give execute priviliges on functions and packages too ?
grant execute any procedure to <user>;
When i give same for fucntion it gives following error,
SQL> grant execute any function to user2;
grant execute any function to user2
ERROR at line 1:
ORA-00990: missing or invalid privilege
Thanks.

EXECUTE ANY PROCEDURE grants permission to all procedures and all functions, whether stand alone or packaged.
Hopefully, you're well aware of this, but the various ANY privileges, like EXECUTE ANY PROCEDURE, are exceptionally powerful. You want to be very cautious about granting those privileges because they can introduce a number of security holes.
Justin

Similar Messages

Why doesn't the "grant execute any procedure" work?

Hi to all.
I want to grant the execute privilege for all SYS schema functions/procedures. To achieve it I do the following:
SQL> connect sys/*****@orcl
Connected to Oracle Database 10g Enterprise Edition Release 10.2.0.4.0
Connected as SYS
SQL> create user test identified by test;
User created
SQL> grant create session to test;
Grant succeeded
SQL> grant execute any procedure to test;
Grant succeeded
According to the [http://download.oracle.com/docs/cd/B19306_01/server.102/b14200/statements_9013.htm] the "grant execute any procedure" - grants Execute procedures or functions, either standalone or packaged.
So, the steps seem to be right. Then, I try to connect to the test user and execute any procedure from the SYS schema, for example, dbms_lock.sleep:
SQL> connect test/test@dizzy/orcl
Connected to Oracle Database 10g Enterprise Edition Release 10.2.0.4.0
Connected as test
SQL> begin
2 sys.dbms_lock.sleep(1);
3 end;
4 /
begin
sys.dbms_lock.sleep(1);
end;
ORA-06550: line 3, column 1:
PLS-00201: identifier 'SYS.DBMS_LOCK' must be declared
ORA-06550: line 3, column 1:
PL/SQL: Statement ignored
So, the execution fails due to insufficient rights. However, the direct grant on the sys.dbms_lock works!
SQL> connect sys/*****@dizzy/orcl as sysdba
Connected to Oracle Database 10g Enterprise Edition Release 10.2.0.4.0
Connected as SYS
SQL> grant execute on dbms_lock; to test;
grant execute on dbms_lock; to test
ORA-00911: invalid character
SQL> grant execute on dbms_lock to test;
Grant succeeded
SQL> connect test/test@dizzy/orcl
Connected to Oracle Database 10g Enterprise Edition Release 10.2.0.4.0
Connected as test
SQL> begin
2 sys.dbms_lock.sleep(1);
3 end;
4 /
PL/SQL procedure successfully completed
So, to be sure that the grant on any procedure from the definite scheme is given, should I avoid giving the execute any procedure grant?
P.S. Is there any special tag for code?
Thanks in advance.

Sybrand, thank you for the reply.
You are right. I tried to connect by another user NOT SYS and created the function:
SQL> create user testic identified by i;
User created
SQL> grant create session, execute any procedure to testic;
Grant succeeded
SQL> create or replace function get1 return number is
2 begin
3 return 1;
4 end;
5 /
Function created
SQL> connect testic/i@orcl
Connected to Oracle Database 10g Enterprise Edition Release 10.2.0.4.0
Connected as testic
SQL> select get1 from dual;
select get1 from dual
ORA-00904: "GET1": invalid identifier
SQL> select kaisa_rgali.get1 from dual;
      GET1
         1Thank you for the tag. This's exactly what I asked about.
Finally, I tried t open the hyperlink http://download.oracle.com/docgs/cd/B10501_01/server.920/a96521/privs.htm but it failed.

"GRANT EXECUTE ANY PROCEDURE TO " does not work in some cases

Hello,
I some of my PL/SQL-packages I'm using DBMS-packages.
Because I don't want to grant access for every single package, I granted EXECUTE ANY PROCEDURE to the user/schema of my packages.
This did work in several installation.
But for what reason ever, in one installation DBMS_RANDOM cannot be used (DBMS_RANDOM must be declared). If I explicitly grant execute on this package, it works. When I revoke it and renew the ANY PROCEDURE, it doesn't again.
What's wrong.
Version 11.2.0.2 on Win2008R2
Regards,
Mynz

Mynz wrote:
Hello,
I some of my PL/SQL-packages I'm using DBMS-packages.
Because I don't want to grant access for every single package, I granted EXECUTE ANY PROCEDURE to the user/schema of my packages.
This did work in several installation.
But for what reason ever, in one installation DBMS_RANDOM cannot be used (DBMS_RANDOM must be declared). If I explicitly grant execute on this package, it works. When I revoke it and renew the ANY PROCEDURE, it doesn't again.
What's wrong.privilege acquired via ROLE do NOT apply within named PL/SQL procedures/functions

Does GRANT CREATE ANY PROCEDURE auto grants EXECUTE on created obj to user?

I have a User ABC which has GRANT CREATE ANY PROCEDURE on schema XYZ. Now, I create a new Function in schema XYZ using my ID ABC named "func123". My question is, would my User ID ABC being creator of func123 be able to EXECUTE it by default ???
Note: ID ABC has not been explicitly given GRANT EXECUTE on this func123 function, neither it has GRANT EXECUTE ANY PROCEDURE on schema XYZ.
Thanks in advance.

There is no such thing as 'create any procedure on schema xyz'. When an user has create any procedure, he can create a procedure in any schema, including SYS.
You have an unprotected and unsecured database by granting this powerful privilege to multiple users.
Also when you create a procedure in a different schema, that schema becomes the owner, not the user creating it.
Kindly brush up your basics and (re)read documentation.
Sybrand Bakker
Senior Oracle DBA

Make execute privileges on a package default to all schemas

I have to grant execute privileges on dbms_aq package to schemas created in our database. Instead of granting these privileges explicitly after a schema is created is there a way to make dbms_aq to be executable for all schemas and any new schemas created there after.
Something along the lines of dbms_utility having executable privileges for all schemas.
thanks for your help

"grant execute on dbms_aq to public"

Granting roles permission to run packages created by somone else

Hi there,
I'm using Oracle 9i and I've written a package that has several functions that need to be run by a role other than the owner. I have 2 roles I granted execute permission on the package itself but when I log in to our app as another user with one of those granted roles, I get the 'insufficient privilege' error.
My DBA mentioned something about doing a pl/sql wrapper. I did a search under wrap in the oracle index and came up with a wrap utility. If this is what he meant, I don't understand how that helps with permissions if the wrap util just encrypts my package. How do the roles get permission to run it then?
Thanks
Evita

If you call the stored procedure from a PL/SQL block, there will be a problem that PL/SQL does not, by default, recognize privileges granted through a role. You can either make a direct grant or you can change the PL/SQL block to specify authid current_user.
Justin
Distributed Database Consulting, Inc.
http://www.ddbcinc.com/askDDBC

Execute any procedure for developers

Hello,
our developers want the privilege "execute any procedure" because the self-programmed application needs execute on unknown procedures. (Oracle 10.2) It's the application-administrator-user on which the development has full access.
On AskTom I read, that "execute any procedure" is extremely powerful an should not be granted to normal users.
I would like to know, if this is only not recommended for O7_DICTIONARY_ACCESSIBILITY=true or under any circumstances.
Any ideas how we can find out, which procedures are used by this user? Or on the other hand, which are the risky elements from "execute any procedure"?
Any arguments against giving this privilege are welcome, I have to give a statement on this.
Thanks,
M.Hannibal

Ok. I just browsed through Asktom for this issue and it is true that there are NO risks highlighted over there after granting "EXECUTE ANY PROCEDURE" to a user.
Though, I would like to put forth following points.
1. Some of procedures/functions in SYS as not supposed to be used by the normal database users (results can be unpredictable)
2. Upon grant of this privilege, the user can execute procedure of any schema in the database. This can be problematic if an user of PAYROLL schema starts executing procedures of FINANCE schema and change all accounts (kind of) related information.
In your situation, you can handle this by creating a DDL trigger in the schema where the procedure will be created. Via trigger, grant execute on this procedure to the user under which the application is going to run.
Thus you will have control over the procedure execution and you can easily track down the problem if somehting goes wrong (as will then you know who all can execute a particular procedure).

About "EXECUTE ANY PROCEDURE" privilege

I found in our EBS system. New user is default granted "EXECUTE ANY PROCEDURE" privilege and it seems I cannot revoke it. Is this supposed to be?

What is the application release?EBS: 12.1.1
database: 11.1.07.0
Is this new user a custom user or seeded one?It is a custom user. I used admin account to create a new user. Only explicitly grant create seesion privilege.
Do you get any error when you try to revoke it?No error. It works fine.
If this is a custom schema user, you need to verify why this privilege was granted to the user and what is the impact if you revoke it (try it on a test instance first).It seems be granted default. The impact is the user has more privileges supposed to grant.

Error granting EXECUTE on DBMS_JAVA:-4042:ORA-04042: procedure, function,

Hi .
I 'm experiencingn the following problem when granting acess to the sys user can any one help please in this issue.I 'm using an oracle 10 g on a solaris system.
Granting EXECUTE on DBMS_JAVA to SYSTEM WITH GRANT OPTION
Error granting EXECUTE on DBMS_JAVA:-4042:ORA-04042: procedure, function,
Thanks.

You need to execute this with user "sys"
see my test please:
oracle@myserver:~> sqlplus "/ as sysdba"
SQL*Plus: Release 11.2.0.1.0 Production on Tue Aug 17 13:24:28 2010
Copyright (c) 1982, 2009, Oracle. All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
sys@MYSID> grant EXECUTE on DBMS_JAVA to SYSTEM WITH GRANT OPTION;
Grant succeeded.
sys@MYSID>as I check ORA-04042: procedure, function, package, or package body does not exist
I can see that you issue is that you don't have Oracle JVM option installed in your database.
start database configuration assistant (dbca) choose configure database options operations select your DB SID and install Oracle JVM for your database (find it under Standard database components button)
HTH, Regards

Grant execute on DBMS_CRYPTO package (11R1)

I figured out I needed to grant my user access to this SYS package using:
SQL> grant execute on DBMS_CRYPTO to lob_demo;
Grant succeeded.
yet after doing this, I still get this error:
SQL> select DBMS_CRYPTO.HASH(bytes, DBMS_CRYPTO.HASH_SH1) from blobslicer where id=1;
select DBMS_CRYPTO.HASH(bytes, DBMS_CRYPTO.HASH_SH1) from blobslicer where id=1
ERROR at line 1:
ORA-06553: PLS-221: 'HASH_SH1' is not a procedure or is undefined
Yet if I use the numeric constant for DBMS_CRYPTO.HASH_SH1 (3), it works:
SQL> select DBMS_CRYPTO.HASH(bytes, 3) from blobslicer where id=1;
F5A7338EFFEB15A49AFC9545393EF685BB51F931
So what am I missing that prevents me from having access to a constant in the package when I can successfully use one of the function of that same package?
Thanks, --DD

Maybe, that makes a little bit clearer the difference
between usage of package constants in sql and pl sql...That's what I suspected, thank you for hammering the point home Maxim.
The taken away for me is that package constants are not available to SQL code, only to PL/SQL code. (irrelevant of their type most likely).
I actually tried to grant my user SELECT privileges on the package, because accessing a constant from a package is more akin to SELECT than EXECUTE, but of course one cannot do that.
Thank you both again for the help. --DD

To grant execute on a specific procedure in a package

is there a way to grant execute on a specific procedure in a package without granting execute to the package itself.

Case 1: If you have package function,
->Then you can create a view on it and give access to specific user.
Case 2: If you have package procedure
-> I think, there is no direct method to GRANT part of package.
-> Make GLOBAL procedure only the one that you want to grant to the user. Now if you grant the package (having few global), user only able to access the GLOBAL's only..
So how do u implement?
PACKAGE global_pkg
Procedure first_global_procedure;
Procedure second_global_procedure;
END global_pkg;
Now You create Package as per user access:
Package user_1_pkg
call first_global_procedure;
END;
Package user_2_pkg
call second_global_procedure;
END;
Now, you Grant user_1_pkg to USER1 and user_2_pkg to USER2

How can i find start line of any functions or procedures stored in package body?

hi
how can i find start line of any functions or procedures stored in package body?
is there any way to write a query from for example user_source?
thanks

how can i find start line of any functions or procedures stored in package body?
Why? What will you do differently if a procedure starts on line 173 instead of line 254?
Tell us what PROBLEM you are trying to solve so we can help you find the best way to solve it.
If you use PL_SCOPE that info is available in the *_IDENTIFIERS views. See 'Using PL/Scope in the Advanced Dev Doc
http://docs.oracle.com/cd/B28359_01/appdev.111/b28424/adfns_plscope.htm
Try this simple sample code. The query is modified from that doc sample:
-- tell the compiler to collect the info
ALTER SESSION SET PLSCOPE_SETTINGS='IDENTIFIERS:ALL';
-- recompile the package
CREATE OR REPLACE package SCOTT.pack1 as
PROCEDURE proc1;
PROCEDURE proc2;
END;
CREATE OR REPLACE package BODY SCOTT.pack1 as
PROCEDURE proc1 IS
BEGIN
NULL;
END;
PROCEDURE proc2 IS
BEGIN
proc1;
END;
PROCEDURE proc3 IS
BEGIN
proc1;
proc2;
END;
END;
-- query the info for the package spec
WITH v AS (
SELECT    Line,
            Col,
            INITCAP(NAME) Name,
            LOWER(TYPE)   Type,
            LOWER(USAGE) Usage,
            USAGE_ID,
            USAGE_CONTEXT_ID
    FROM USER_IDENTIFIERS
      WHERE Object_Name = 'PACK1'
        AND Object_Type = 'PACKAGE'
SELECT LINE, RPAD(LPAD(' ', 2*(Level-1)) ||
                 Name, 20, '.')||' '||
                 RPAD(Type, 20)||
                 RPAD(Usage, 20)
                 IDENTIFIER_USAGE_CONTEXTS
FROM v
START WITH USAGE_CONTEXT_ID = 0
CONNECT BY PRIOR USAGE_ID = USAGE_CONTEXT_ID
ORDER SIBLINGS BY Line, Col
LINE,IDENTIFIER_USAGE_CONTEXTS
1,Pack1............... package             declaration
2, Proc1............. procedure           declaration
3, Proc2............. procedure           declaration
-- query the info for the package body - change 'PACKAGE' to 'PACKAGE BODY' in the query above
LINE,IDENTIFIER_USAGE_CONTEXTS
1,Pack1............... package             definition
2, Proc1............. procedure           definition
6, Proc2............. procedure           definition
8,    Proc1........... procedure           call
10, Proc3............. procedure           declaration
10,    Proc3........... procedure           definition
12,      Proc1......... procedure           call
13,      Proc2......... procedure           call

GRANT EXECUTE ON SCHEMA.PACKAGE.PROCEDURE TO USER

Hi,
GRANT EXECUTE ON SCHEMA.PACKAGE.PROCEDURE TO USER
returns:
ORA-00905, do you know why? Can I grant privileges on procedure inside package?
thanks

As per my knowledge of oracle, we cannot grant privileges on procedure inside a package.
 
Raj 
www.oraclebrains.com<a>
 POWERED by the people, to the people and for the people WHERE ORACLE IS PASSION.
 
Sorry Leonardo Horikian & Kamal Kishore, I was late and didn't know that you guys have already posted the answer.
Message was edited by:
rajs

Grant execute on a Package

I am trying to grant on a package and I am getting this error, what key word is missing.
1* GRANT EXECUTE ON PACKAGE MDRXML.mx_submit_message_pkg_raj to MDRCENTRAL
SQL> /
GRANT EXECUTE ON PACKAGE MDRXML.mx_submit_message_pkg_raj to MDRCENTRAL
ERROR at line 1:
ORA-00905: missing keyword
Will appreciate all the help

Hi,
you can try this.
GRANT EXECUTE ON MDRXML.mx_submit_message_pkg_raj to MDRCENTRAL
thanks

Grant Execute on package Specification

How to give grant to package specification to another user?
The package has only specification and no package body
in package specification i have defined some constants variables which i need to access from another user?
Current if i give grant execute from the other user it is shwoing up only blank body......

Works for me...
As test_user...
SQL> create or replace package test_vars is
2 g_number number := 100;
3 end;
4 /
Package created.
SQL> grant execute on test_vars to scott;
Grant succeeded.As scott...
SQL> create synonym test_vars for test_user.test_vars;
Synonym created.
SQL> set serverout on
SQL> begin
2 dbms_output.put_line(test_vars.g_number);
3 end;
4 /
100
PL/SQL procedure successfully completed.
SQL>

Grant execute any function or package

Similar Messages

Maybe you are looking for