How to revoked 'ANY' privileges being granted to user or role

Hi all,
I need to be revoked all 'ANY' privileges that have been granted to all non-DBA user or Role in the database.
To achieve this what i assume is
1> i need to find out Role as well all user who are non-DBA
2> For all non-DBA user i need to find out and revoked 'ANY' privileges if they would have.
Here i need some information about all tables related to privilieges and non-DBA users
The below are some example as a reference.
USER Privileges
CTXADMIN SELECT ANY TABLE
PUBLIC MERGE ANY VIEW
LAXORA ANALYZE ANY
EXECUTE ANY PROCEDURE
GRANT ANY ROLE
INSERT ANY TABLE
SELECT ANY TABLE
LAX_NEW ANALYZE ANY
CREATE ANY TABLE
DELETE ANY TABLE
DROP ANY TABLE
INSERT ANY TABLE
SELECT ANY TABLE
USER_NEW SELECT ANY TABLE
Thank n reagrds
Laxman

Hi,
LAX_ORA wrote:
Hi all,
I need to be revoked all 'ANY' privileges that have been granted to all non-DBA user or Role in the database.
To achieve this what i assume is
1> i need to find out Role as well all user who are non-DBA
2> For all non-DBA user i need to find out and revoked 'ANY' privileges if they would have.
Here i need some information about all tables related to privilieges and non-DBA users
The below are some example as a reference.
USER Privileges
CTXADMIN SELECT ANY TABLE
PUBLIC MERGE ANY VIEW
LAXORA ANALYZE ANY
EXECUTE ANY PROCEDURE
GRANT ANY ROLE
INSERT ANY TABLE
SELECT ANY TABLE
LAX_NEW ANALYZE ANY
CREATE ANY TABLE
DELETE ANY TABLE
DROP ANY TABLE
INSERT ANY TABLE
SELECT ANY TABLE
USER_NEW SELECT ANY TABLE
Thank n reagrds
LaxmanYou can fiind out all the users and roles who have been granted system privileges by querying dba_sys_privs.
For example:
SELECT     grantee
,     privilege
FROM     dba_sys_privs
WHERE     privilege     LIKE '% ANY %'
;The grantee column includes users and roles together.
If you want to find which users have the dba role, then query dba_role_privs.

Similar Messages

How to revoke all privileges?

hi all. How to revoke all privileges from user? B-)

For object privileges run :
SELECT 'revoke ' || PRIVILEGE || ' on ' || table_name || ' from ' || grantee
|| ';\'
FROM dba_tab_privs
WHERE grantee = 'USERNAME'
For system privileges run:
SELECT 'revoke ' || PRIVILEGE || ' from ' || grantee || ';\'
FROM dba_sys_privs
WHERE grantee = 'USERNAME'
Then run both results in Sql*Plus

Can't grant privilege on column to user via role?

Hi:
From what I read in the docs I should be able to create a role that has UPDATE privs on a column of a table, and then grant that role to a user, who should be able to update the column of the table. I get "insufficient privileges" when I try that, although it works as advertised if I grant directly to the user. Am I mis-reading the docs?
Session GAFF:
CREATE TABLE "GAFF"."FOO2"
   (    "F1" NUMBER,
    "F2" NUMBER,
    "F3" VARCHAR2(50),
    "F4" NUMBER,
     CONSTRAINT "FOO2_PK" PRIMARY KEY ("F1")
create role foo2_u_f2;
grant update (f2) on foo2 to foo2_u_f2 ;
grant select on gaff.foo2 to play ;
grant foo2_u_f2 to play ;session PLAY:
update gaff.foo2 set f2 = 1 where f1 = 1ORA-01031: insufficient privileges

Most likely role foo2_u_f2 is not a default role for user play. Initially, when user is created default role is set to ALL. Later it can be changed to NONE or a set of roles. Login as play and issue:
select * from session_roles
/I bet you will not see foo2_u_f2. Then issue:
select granted_role,default_role from user_role_privs
/That will give you a list of user play default roles. You can either issue:
set role foo2_u_f2
/This will enable foo2_u_f2 role in current session. Or you can login as privileged user and issue ALTER USER DEFUALT ROLE ...,foo2_u_f2.
SY.

Which privilege to grant to users?

Hi guys
Normally the sys as sysdba user is the only user who can grant privileges to other users.
I need any user on my database to be able to grant privileges to any other user.
What privilege do I need to grant to each one of my users so that they can grant privileges to each other in the future without having to connect as sys user and grant privileges?
Many thanks in advance
Cheers
Ciaran

And for individual grants for objects not assigned to a role or perhaps as a standard the object privilege can be granted as
"grant select [etc...] on object_name to sec_admin_user with grant option;"
This allows a non-DBA no special privileged user to handle grant requests.
HTH -- Mark D Powell --

How to make any login screen forgets (login user names) ?

In facebook and yahoo login screens, I find many (mistyped) names stored in a drop down menu to choose a user name
I want to remove some entries from this drop down menu

Hello,
I am not sure if you can remove specific entries. But if you want to remove all of your history, or history from a certain time period, you can do so by:
* History (or menu [[Image: New Fx Menu]] > History) > Clear Recent History
Select Form & Search history, and anything else you would like to clear.
You can change your settings as well to automatically delete this information in:
* For Windows: Tools (or [[Image: New Fx Menu]]) > Options > Privacy
You can choose to Never Remember History or set custom settings to only clear certain information when Firefox closes.
Please see the article [[Remove recent browsing, search and download history]] for more information.

How to revoke everything from a user when opening a new session.

HI,
I am using oracle 10g Express Edition and SQL Developer.
I have 2 user, 2 database connections in my SQL Developer.
First user is Oracle and its database connection is called TCF.
Second user is SMITH and its database connection is called TCF_SMITH.
Oracle user has privileges to do anything.
SMITH user has no privileges except for CREATE SESSION.
What I am trying to achieve is assign a user to a role (this role will have grants to select, insert , update from tables) for the current session (this step is successful), and then revoke
The role from that user (set it back to its default/or revoke everything from it) if opening another session, or session has been terminated (what I am trying to achieve).
From TCF I was able to do the following:
CREATE synonym SMITH.EMP_IOD FOR EMP_IOD;
CREATE ROLE TCF_I;
GRANT SELECT, INSERT, UPDATE ON EMP_IOD TO TCF_I;
GRANT TCF_I TO SMITH;In TCF_SMITH
SMITH has the same privileges as TCF_I.
so, smith now can select, insert , and update from EMP_IOD table.
If I open another TCF_SMITH session, and select * from EMP_IOD I should not be able to see any of the records.
I am trying to make this session base only. Unfortunately when opening another session I am able to select, update and insert records in the new session.
Is there a way to make this session based ?
How can I revoke everything from user SMITH from TCF connection ?
Thanks,

Oh My Good Lord!
Rooney,
What are you attempting to do ?
In programming anything can be achieved, but there are speicifc tools to solve specific problems .
I think you are trying to use fork to paint a wall* (If painting the wall indeed is your requirement).
The "need" as you say...
+The need for this is to grant the user different roles each time the user logs in.
for example I can log in 5 different time in one week with different role each time.
Moday I could have access to X,Y,Z,
Tuesday I could have access to X,A,B
Wednesday I could have access to A,B,C.+
... is to solve WHAT PROBLEM?
Please describe your original requirement , not what you think should be the solution/tool to satisfy the requirement.
In your previous thread you "solved" privilege/role problem by creating SYNONYM. That does not compute at all.
Re: database roles seems like its not working for me - your help is appreciated
Think about it. We are here to help each other as best we can.
Please read more* about Oracle capabilities and "tools" it provides.
http://tahiti.oracle.com/
Especially the Oracle Concepts Guide ...
http://download.oracle.com/docs/cd/B14117_01/server.101/b10743.pdf
Also, please take time to respond as "helpfully" as possible. each response from you should take you closer to the solution.
Hopefully, your original requirement will be solved.
vr,
Sudhakar B.

How to identify which privilege is missing?

Hi,
   If any query comes out with insufficient privileges, how do we identify which privilege is missing instead of searching in Oracle docs. Is there any table(dict or oracle internal) we can take aid to find out required privilege.

Oracle does not store (other than the document) the possible privileges that could be granted to a specific user/object. But the privileges that are granted can be viewed in dictionary tables listed below.
SQL> select *
2    from dictionary
3   where table_name like '%PRIV%'
4   order
5      by table_name;
TABLE_NAME                     COMMENTS
ALL_COL_PRIVS                  Grants on columns for which the user is the grantor, grantee, owner,
                                or an enabled role or PUBLIC is the grantee
ALL_COL_PRIVS_MADE             Grants on columns for which the user is owner or grantor
ALL_COL_PRIVS_RECD             Grants on columns for which the user, PUBLIC or enabled role is the grantee
ALL_REPGROUP_PRIVILEGES        Information about users who are registered for object group privileges
ALL_TAB_PRIVS                  Grants on objects for which the user is the grantor, grantee, owner,
                                or an enabled role or PUBLIC is the grantee
ALL_TAB_PRIVS_MADE             User's grants and grants on user's objects
ALL_TAB_PRIVS_RECD             Grants on objects for which the user, PUBLIC or enabled role is the grantee
COLUMN_PRIVILEGES              Grants on columns for which the user is the grantor, grantee, owner, or
                                an enabled role or PUBLIC is the grantee
DBA_AQ_AGENT_PRIVS
DBA_COL_PRIVS                  All grants on columns in the database
DBA_PRIV_AUDIT_OPTS            Describes current system privileges being audited across the system and by user
DBA_REPGROUP_PRIVILEGES        Information about users who are registered for object group privileges
DBA_ROLE_PRIVS                 Roles granted to users and roles
DBA_RSRC_CONSUMER_GROUP_PRIVS Switch privileges for consumer groups
DBA_RSRC_MANAGER_SYSTEM_PRIVS system privileges for the resource manager
DBA_SYS_PRIVS                  System privileges granted to users and roles
DBA_TAB_PRIVS                  All grants on objects in the database
GV$ENABLEDPRIVS                Synonym for GV_$ENABLEDPRIVS
ROLE_ROLE_PRIVS                Roles which are granted to roles
ROLE_SYS_PRIVS                 System privileges granted to roles
ROLE_TAB_PRIVS                 Table privileges granted to roles
SESSION_PRIVS                  Privileges which the user currently has set
TABLE_PRIVILEGES               Grants on objects for which the user is the grantor, grantee, owner,
                                or an enabled role or PUBLIC is the grantee
USER_AQ_AGENT_PRIVS
USER_COL_PRIVS                 Grants on columns for which the user is the owner, grantor or grantee
USER_COL_PRIVS_MADE            All grants on columns of objects owned by the user
USER_COL_PRIVS_RECD            Grants on columns for which the user is the grantee
USER_REPGROUP_PRIVILEGES       Information about users who are registered for object group privileges
USER_ROLE_PRIVS                Roles granted to current user
USER_RSRC_CONSUMER_GROUP_PRIVS Switch privileges for consumer groups for the user
USER_RSRC_MANAGER_SYSTEM_PRIVS system privileges for the resource manager for the user
USER_SYS_PRIVS                 System privileges granted to current user
USER_TAB_PRIVS                 Grants on objects for which the user is the owner, grantor or grantee
USER_TAB_PRIVS_MADE            All grants on objects owned by the user
USER_TAB_PRIVS_RECD            Grants on objects for which the user is the grantee
V$ENABLEDPRIVS                 Synonym for V_$ENABLEDPRIVS

Oracle recommends that you revoke EXECUTE privileges on powerful packages f

Oracle recommends that you revoke EXECUTE privileges on powerful packages from PUBLIC
Got on error on the home page of Enterprise Manager and read that I should run the code below to correct the problem, but when I click on the link at the bottom of EM to go to iSQL*Plus and choose to connect as sysdba I get a popup asking for me to input a password for my computer so I tried my local computer username and password, my network username and password and even my database username and password and neither lets me in. I can login under Normal but then I do not have rights to execute the command.
revoke execute on utl_file from public;
I know I have my computer username and password correct because I had to enter it to shutdown the database yesterday.
And I had a problem with my listener not knowing the SID, but the error has since went away, but I do have an error on my listener saying
Disk Utilization for 0 C: is 151.45%
Edited by: jamesH2 on Aug 29, 2008 9:20 AM

Hi James,
Where you saw that Oracle recommend that? If you are refering to the Db console recomendations please take a look on this note also: Note:343620.1
If you revoke any privilege from PUBLIC it becomes your own responsibility
to ascertain that all your applications will keep working. The same goal can often be accomplished
by replacing the privileges formerly granted to PUBLIC to some individual users or
roles.
Please take a look on this Metalink Note: 247093.1 Be Cautious When Revoking Privileges Granted to PUBLIC
Regards,
Francisco Munoz Alvarez
www.oraclenz.com
Edited by: F. Munoz Alvarez on Aug 30, 2008 1:31 AM

How to revoke fulfilled license upon refund request.

Hi,
I am strugling with revoking fulfilled licenses when customer request for refund. I deleted respective license from Admin Console but it just restrict them not to download further on any device. But they are still able to use the book if already downloaded/fulfilled.
Any suggestion to tackle this will be much appreciated.

How to revoke returnable license already on a user's device? If I delete license from Admin Console, user still able to read already fulfilled e-book. The only thing for revocation working for us when customer itself return e-book. Please let me know if any other way to revoke already fulfilled license?

How to restrict AUTHENTICATED_USERS privileges

It seems by default all Portal login user has privileges to create and manage application and content area.
How can I revoke these privileges from normal login user?

How the program will recognize the users which should not send.
System cannot recognize anything unless we code.
You must be knowing who are the users to be restricted, so better create a z table with those users
and eliminate them from your receiver internal table before triggering that FM.

How to revoke call dbms

How to revoke a privilege given with the following statement?
call dbms_java.grant_permission('myschema','java.net.SocketPermission' ,'10.10.16.16' , 'connect,resolve');
Thanks

Wrong guess but did you check revoke_permission procedure in dbms_java.

How to revoke access of PUBLIC permissioned objects for one DB User.

Hi
I am using 10.2.0.4.0 , and i have a production1 schema and production2 schema in one Database.
Some of the objects of Production1 schema having PUBLIC permissions.
Eventhough some of the Production1 schema objects are PUBLIC production2 schema should not able access.
Is it possible, if possible can you help me.
Thanks in Advance.

To add to what others have already posted consider replacing the grants to public with grants to a role and grant that role to all users except the username in question and future users who fall into the same category as far as what you want them to see.
If you cannot change the public grants then you basically have to live with the target user having access to the objects.
IF public synonyms are used to access the objects then in the target user account you could potentially create a set of private synonyms that point to an empty set of tables by the same name. In the case of where access is via an application under the target user username this would mast the tables of interest; however, if the user has direct access to Oracle it would not stop them from accessing the objects using the owner.table_name format as this would bypass using the private or public synonyms.
Generally speaking all object access privileges should be granted to user created roles and usernames should be granted only those roles necessary for them to perform their job related tasks.
HTH -- Mark D Powell --

How to check whether system privilege are granted

How to check whether system privileges like 'create session' and other ones are granted for user.
Is there any sys table where this information is available?
Regards - Neuron

Keep in mind select * from dba_sys_privs where grantee = 'some-user' will give you a list of privileges granted to some-user directly. To get complete list of system privs granted to a user both directly an via roles use:
ACCEPT USER PROMPT 'Please enter user name: '
COLUMN PATH FORMAT A90
SET LINESIZE 132
SELECT PATH,
        PRIVILEGE
FROM DBA_SYS_PRIVS,
          SELECT 'DIRECT GRANT' PATH,
                  '&USER' GRANTED_ROLE
            FROM DUAL
         UNION ALL
          SELECT LTRIM(SYS_CONNECT_BY_PATH(GRANTED_ROLE,'->'),'->') PATH,
                  GRANTED_ROLE
            FROM DBA_ROLE_PRIVS
            START WITH GRANTEE = UPPER('&USER')
            CONNECT BY PRIOR GRANTED_ROLE = GRANTEE
WHERE GRANTEE = GRANTED_ROLE
/Now on top of privileges granted to a user, user also has privileges granted to PUBLIC. To get privileges user receives via PUBLIC run the above script specifying PUBLIC at the prompt.
SY.

How to revoke the alter privilege.

I'm wondering how to revoke the alter privilege for the owner of a table.
Any ideas?
Thanks
Todd

nop, owner is the boss, this is DAC. If you don't trust the user, you don't need to give user connect to the schema.
<BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:</font><HR>Originally posted by Todd Thompson ([email protected]):
I'm wondering how to revoke the alter privilege for the owner of a table.
Any ideas?
Thanks
Todd<HR></BLOCKQUOTE>
null

How to "revoke" privilege with dbms_xdb.changeprivileges

Dear All!
How to "revoke" privilege granted with the following code
DECLARE
r pls_integer;
priv xmltype;
priv_data varchar2(2000);
BEGIN
priv_data :=
'<ace
xmlns="http://xmlns.oracle.com/xdb/acl.xsd"
xmlns:dav="DAV:"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.oracle.com/xdb/acl.xsd
http://xmlns.oracle.com/xdb/acl.xsd
DAV:http://xmlns.oracle.com/xdb/dav.xsd">
<principal>DVLP</principal> <grant>true</grant>
<privilege><all/></privilege>
</ace>';
priv := xmltype.createxml(priv_data);
r := dbms_xdb.changeprivileges('/xdbconfig.xml', priv);
END;
This code is generated by Enterprise Manager
I guessed that it is necessary to replace grant with deny
But there is not schema defenition for deny is parent 'ace'
Thank you in advance for help
Regards
Artem

Dear Mark!
Thank you for you reply
I'll try and let you know about results
Note that This code was generated by Enterprise Manager
and it seems that it generates the same code when you try
to grant and revoke privilege!
Regards
Artem

How to revoked 'ANY' privileges being granted to user or role

Similar Messages

Maybe you are looking for