How to restrict a schema owner from granting privileges to other users.

How can we restrict a schema owner from granting privileges to other users on his objects (e.g. tables). Lets say we have user called XYZ and he has tables in his schema TAB1, TAB2 an TAB3. How can we restrict user XYZ from granting privileges on TAB1, TAB2 and TAB3 to other users in the database. Is it possible in Oracle 10g R2? Any indirect or direct way to achieve this? Please help on this.
Thanks,
Manohar

Whenever someone is trying to prevent an object owner from doing something, that's generally a sign of a deeper problem. In a production database, the object owner shouldn't generally have CREATE SESSION privileges, so the user shouldn't be able to log in, which would prevent the user from issuing any grants.
As a general rule, you cannot stop an object owner from granting privileges on the objects it owns. You can work around this by creating a database-level DDL trigger that throws an exception if the user issuing the statement is XYZ and the DDL is a GRANT. But long term, you probably want to get to the root of the problem.
Justin
Edited by: Justin Cave on Nov 6, 2008 9:52 PM
Enrique beat me to it.

Similar Messages

How to keep my Aperture library from showing up in other user's iPhoto?

I use an iMac 24 with OS 10.8.2 I use Aperture on my account and my wife and kids use iPhoto on their separate accounts on the same computer.
For some reason, over the last few months, everytime they open thier iPhoto, my Aperture photos show up first in there. They have to wait until iPhoto stops its spinning beach ball (creating previews maybe?) before they can hit the Events box to find their own photos.
I have never set anything up to share libraries or anything like that. This behavior started on its own, possibly during one of the recent system upgrades. I have looked in the iPhoto preferences to see if there was an option to "automatically open Aperture library at launch" or something similar but could not find any such thing. Even a search on these boards has been inconclusive.
Does anyone know how I can keep all these iPhotos from opening up other libraries by default?
This is almost as annoying as the 'New software is available" alert message which keeps popping up in everyone's account, even the non admin ones and even after I have done all the available software updates.
Thank you for any help.
Bo

Thank you Frank. I did check those settings and none of them were "on".
Here are two new bits of info to narrow down the issue: It seems that this behavior happens only the first time after I import a new set of images in Aperture from a SD card, and only the first time iPhoto is opened after that operation.
In other words:
1. Import photos in Aperture in my account
2. The first time one opens iPhoto in another account it will automatically display the new photos that were imported in my account.
3. as soon as I click on "events" in that iPhoto session, all of these last imported photos disappear and only the ones that belong in that iPhoto library remain. All is working normally from then on.
Really odd. Almost as if a snapshot of the last imports was automatically distributed to all account and not purged until manually done so...
And secondly, although Aperture is teh very latest version, I still have iPhoto '09 (v 8.1.2). I wonder if there is a bit of incompatibility with it and OS 10.8.2 maybe...
Bo

How do I keep my Imessages from being viewed on other devices under my apple ID?

How do I keep my Imessages from being viewed on other devices under my apple ID?

No, you can authorize any number of email addresses on your Apple Id and then select one of those to use as an alternate Send and Recieve for Messages. It isn't necessary to use seperate AppleIDs. I use my phone number on my iPhone and an email address on the iPad.

How do I delete Apple TV from syncing with my other devices

How do I delete Apple TV from syncing with my other devices?

What do you mean syncing? The ATV does not sync with other devices.

How do I stop my SMSs from being read by other family members?

How do i stop my SMSs from being read by other family members?

batterseauser wrote:
They r receiving my text messages onto their iPhones and they are not allowing me access to stop this
Change the password for your AppleID you used to set up iMessaging, and do not tell them the password. Tell them to get their own AppleIDs for use with their own iMessage accounts.

How to send the transport request from one client to other client?

Hello Friends,
I have generated one transport request in one of the client in Development server.Now as it is customizing request so unless and until i transport it to other client within the same server, Changes will not be visible in other clients.So how to transport this customizing request from one client to other client within the same server.
Thanking you guys in advance.
Regards,
Jitendra

Hi Jitendra,
Release your Transport Request via SE10, then go to STMS & import the request first to your quality server, then to your production server.
Apologies for the incorrect inputs, please use SCC1 as advised by other forum members
Hope the above clarifies your query.
Regards,
Vivek
Edited by: Vivek on Mar 16, 2009 1:05 PM

How do I stop Adobe Reader from crashing on my unprivileged user?

I am running Windows 7 and I needed to create an unprivileged user on my computer. When I open a PDF file, it almost instantly crashes (I can view the document for about three seconds). If I simply open Adobe Reader without a PDF and click Edit -> Preferences, it crashes. If I open a PDF in any browser, it crashes.
From what I have been able to surmise, it seems that Adobe Reader is trying to read the registry of my privileged user. I have tried uninstalling Adobe Reader, temporarily giving privileges to my unprivileged user, installing Adobe Reader on that user, and then remove the permissions, but the crash still occurs. The only way to stop Adobe Reader from crashing is to start the program as an administrator or change the account type to administrator. How do I stop Adobe Reader from crashing on my unprivileged user?

It said "Adobe Reader has stopped working" soon after I opened it, but I was still able to scroll down the document. It was only once I pressed Close Program that it stopped working.
Upon trying it a second time, it immediately stopped letting me scroll down when the program crashed. Here is the error log, I receive the exact same exception code every time:
Application Error
Faulting application name: AcroRd32.exe, version: 11.0.1.36, time stamp: 0x50d0b932
Faulting module name: AcroRd32.exe, version: 11.0.1.36, time stamp: 0x50d0b932
Exception code: 0x40000015
Fault offset: 0x000b7e40
Faulting process id: 0x104c
Faulting application start time: 0x01ce02e04f2d96cc
Faulting application path: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
Faulting module path: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
Report Id: 961d161d-6ed3-11e2-9fb2-001fbc09988e

How to change the file type from IMOVIE PROJECT to other types of file

how to change the file type from IMOVIE PROJECT to other types of file??
thank you very much for your help=]

I am not sure what you mean, but once you make a project. Then go to the share menu and you can export the project to iDVD, itunes, mobileme, quicktime.
Share export quicktime movie will allow you to export to a variety of codecs. What specific export are you looking to share the movie in? What is the final source that the movie will be displayed?

Just bought a new laptop but dont know how to transfer my itunes libary from one to the other i have signed into my account but still no music help please

just bought a new laptop but dont know how to transfer my itunes libary from one to the other i have signed in my my new laptop but still no music help please !!!!!!

Signing into the iTunes account has never made content magically appear... it still amazes me that people think this will actually work.
Type "move itunes library" into the search bar or your favorite search engine. You'll find multiple results for how to move the iTunes library.

Grant Privileges to another user

Hi,
I am new to plsql. In course of my learning. I created two tables BOOKS and AUTHORS in orcl database(10g) through SYSDBA.
Again i logged in to SCOTT user account and am unable to see the BOOKS and AUTHORS tables.
Please let me know how do i grant administrative privileges(to edit,delete,insert,update) to SCOTT user for these tables.
Thanks & Regards,
Amrutha.

808099 wrote:
1. Got now that SYSDBA is a role and SYS is user.
2. I was able to login to sqlplus through giving "/ as SYSDBA" as the username. Hence i thought it as user."/ as sysdba" connects to the database as the SYS user using operating system authentication with the SYSDBA role enabled.
3. Secondly, I dont know which schema does my BOOKS table belong to. Because i just ran a create table script in scott/tiger@orcl. PLease suggest how i can know which schema it belongs to.If you connected to the database as the SCOTT user and ran the script to create the table, the table would almost certainly be owned by SCOTT. If you connected to the database as the SYS user and ran the script to create the table, the table would most likely be owned by SYS. If the script specified the schema owner, i.e.
CREATE TABLE library.book ...the table would be created in the specified schema. But you need to have very powerful privileges in order to create objects in other user's schemas and SCOTT does not have those privileges unless you've specifically granted them.
4. Thirdly, I will delete the BOOKS and AUTHORS from SYS and create them in SCOTT user. But thought if GRANT privileges can be an alternative.Not really. It's much better to have the tables owned by the correct schema in the first place. You use grants to allow other users to access (or modify) tables but other users are not going to have the same level of privileges (for example, they're not going to be able to run DDL against the table).
Justin

Grant privileges to a user for user_lock

user_lock.sleep (3000);
i am using it in my procedure.
is it require to grant privileges to a user for user_lock.

There is no built-in package namely user_lock. Actually it is dbms_lock.
http://download-east.oracle.com/docs/cd/B19306_01/appdev.102/b14258/d_lock.htm#sthref3898
I was using dbms_lock few days ago. Yes dba has to give the privilege to use this package.
SQL> grant execute on dbms_lock to scott;
Grant succeeded.
[My experiment]
http://mamohiuddin.blogspot.com/2007/02/plsql-block-abnormal-termination-ed.html

How to fire a schema trigger from outside the schema

A user is using an ad hoc tool similar to SQL Developer called PeopleSoft Application Designer.
He creates a connection to the db, then issues an alter session set current_schema = 'restricted_schema'. The connected user does not have direct privileges on the "restricted_schema" which they call SYSADM.
After changing the schema context in that manner he creates objects in SYSADM. A schema trigger is then fired and grants privileges on the new objects created in SYSADM. Doing the same in either SQL Plus or SQL Developer does not fire the schema trigger.
I think SQL Plus and SQL Dev are working as they should. Altering the session like that does not change your identity - just the schema context. But, when you examine v_$session, the connection with this other tool looks exactly the same as one from SQL Plus or SQL Dev when changing the schema context in the session.
Instead of trying to figure out what this other tool is doing, is there any way for that schema trigger to fire when using this process from one of our tools?

>
A user is using an ad hoc tool similar to SQL Developer called PeopleSoft Application Designer.
He creates a connection to the db, then issues an alter session set current_schema = 'restricted_schema'. The connected user does not have direct privileges on the "restricted_schema" which they call SYSADM.
After changing the schema context in that manner he creates objects in SYSADM. A schema trigger is then fired and grants privileges on the new objects created in SYSADM. Doing the same in either SQL Plus or SQL Developer does not fire the schema trigger.
>
The user CANNOT create objects in any schema without the proper privileges.
Setting the current_schema parameter does not confer ANY additional privileges to a user. See ALTER SESSION in the SQL language doc
http://docs.oracle.com/cd/E14072_01/server.112/e10592/statements_2013.htm
>
CURRENT_SCHEMA
Syntax:
CURRENT_SCHEMA = schema
The CURRENT_SCHEMA parameter changes the current schema of the session to the specified schema. Subsequent unqualified references to schema objects during the session will resolve to objects in the specified schema. The setting persists for the duration of the session or until you issue another ALTER SESSION SET CURRENT_SCHEMA statement.
This setting offers a convenient way to perform operations on objects in a schema other than that of the current user without having to qualify the objects with the schema name. This setting changes the current schema, but it does not change the session user or the current user, nor does it give the session user any additional system or object privileges for the session.
>
If the user connects and sets SYSADM as the current schema and creates objects in SYSADM the user already had privileges to create objects in the SYSADM schema; setting the current schema has nothing to do with it.
So your issue is that the user has privileges to create objects in the SYSADM schema; you need to revoke those privilges (or the role that grants them) to solve your problem.

How to move all the tables from one tablespace to other for a whole schema

Hi,
Is there any way to move all the tables in a schema from one tablespace to other?
If so please help me out to do that.
Thanks
Regards
Gatha

hi,
here is the steps to move SCOTT's objects from their current tablespace to a NEW_TABLESPACE
would be:
1) do an export of all of scott's objects. Make sure no one modifies them after you
begin this process. You will lose these changes if they do.
$ exp userid=scott/tiger owner=scott
2) you would drop all of scotts tables. This will get the indexes as well. I don't
suggest dropping the user SCOTT but rather dropping scott's objects. Dropping scott
would cause any system priveleges SCOTT has to disappear and the import would not restore
them. This script can be used to drop someones tables:
set heading off
set feedback off
set verify off
set echo off
spool tmp.sql
select 'drop table &1..' || table_name || ' cascade constraints;'
from dba_tables
where owner = upper('&1')
spool off
@tmp.sql
3) You would modify the user to not have unlimited tablespace (else the IMP will just
put the objects right back into the tablespace they came from) and then give them
unlimited quota's on the new tablespace you want the objects to go into and on their
temporary tablespace (for the sorts the index creates will do)
alter user SCOTT default tablespace NEW_TABLESPACE
revoke unlimited tablespace from SCOTT
alter user SCOTT quota unlimited on NEW_TABLESPACE
alter user SCOTT quota unlimited on SCOTTS_TEMPORARY_TABLESPACE
4) you will IMP the data back in for that user. IMP will rewrite the create statements
to use the users default tablespace when it discovers that it cannot create the objects
in their original tablespace. Please make sure to review the file imp.log after you do
this for any and all errors after you import.
imp userid=scott/tiger full=y ignore=y log=imp.log
5) you can optionally restore 'unlimited tablespace' to this user (or not). If you do
not, this user can only create objects in this new tablespace and temp (which in itself
is not a bad thing)...
Regards,
Mohd Mehraj Hussain
http://mehrajdba.wordpress.com

OIM 11g-How to restrict the role administrator from seeing "other" roles

Dear All,
How to restrict Administrator from seeing roles he is not suppose to administer?
My administrator is suppose to assign only Role A. When he logs in He can see every single role. How to correct it so that he can see only Role A?
Thank you for your time
Maria

Modify "All User Role Management Policy"

How to restrict number of hits from a browser, within a specific interval.

Hi,
we have a web app in which user clicks on a specific submit continously. This fills up the server threads and other users trying to login either get a timeout or page not found. my questions ---
1. Is there a way to configure weblogic to timeout the httprequest and also the underlying thead which is doing the work.
2. Is there a way to restrict number of requests from a client within a specific interval..
thanks in advance..

Hello Benita
Set the dialog type of your search help = 'A' (dialog depends on set of values).
Regards
Uwe

How to restrict a schema owner from granting privileges to other users.

Similar Messages

Maybe you are looking for