How to restrict the user(Schema) from deleting the data from a table

Question

Hi All,
I have scenario here.
I want to know how to restrict a user(Schema) from deleting the values from a table created in the same schema.
Below is the example.
I have created a table employee in abc schema which has two values.
EMPLOYEE
ABC
XYZ
In the above scenario the abc user can only fire select query on the EMPLOYEE table.
SELECT * FROM EMPLOYEE;
He should not be able to use any other DML commands on that table.
If he uses then Insufficient privileges error should be thrown.
Can anyone please help me out on this.

Answer 1

Hi,
kumar0828 wrote:
Hi Frank,
Thanks for the reply.
Can you please elaborate on how to add policies for a table for just firing a select DML statement on table.See the SQL Packages and Types manual first. It has examples. You can also search the web for examples. This is sometimes called "Virtual Private Database" or VPD.
If you have problems, post a specific question here. Include CREATE TABLE and INSERT statements to create a table as it exists before the policies go into effect, the PL/SQL code to create the policies, and additonal DML statements that will be affected by the policies. Show what the table should contain after each of those DML statements.
Always say which version of Oracle you're using. Confirm that you have Enterprise Edition.
See the forum FAQ {message:id=9360002}
The basic idea behind row-level security is that it generates a string that is automatically added to SELECT and/or DML statement WHERE clauses. For example, if user ABC is only allowed to query a table on Sunday, then you might write a function that returns the string
USER  != 'ABC'
OR      TO_CHAR (SYSDATE, 'DY', 'NLS_DATE_LANGUAGE=ENGLISH') = 'SUN'So whenever any user says
SELECT  *
FROM    table_x
;what actually runs is:
SELECT  *
FROM    table_x
WHERE   USER  != 'ABC'
OR      TO_CHAR (SYSDATE, 'DY', 'NLS_DATE_LANGUAGE=ENGLISH') = 'SUN'
;If you want to prevent any user from deleting rows, then the policy function can return just this string
0 = 1Then, if somone says
DELETE  employee
;what actually gets run is
DELETE  employee
WHERE   0 = 1
;No error will be raised, but no rows will be deleted.
Once again, it would be simpler, more efficient, more robust and easier to maintain if you just created the table in a different schema, and not give DELETE privileges.
Edited by: Frank Kulash on Nov 2, 2012 10:26 AM
I just saw the previous response, which makes some additional good points (e.g., a user can always TRUNCATE his own tables). ALso, if user ABC applies a security policy to the table, then user ABC can also remove the policy, so if you really want to prevent user ABC from deleting rows, no matter how hard the user tries, then you need to create the policies in a different schema. If you're creating things in a different schema, then you might as well create the table in a different schema.