New User and Privileges - Puzzling

Question

Hi
I know I am missing something here. It is quite puzzling.
I have a schema USER1 - that has public synonyms.
created a new schema USER2 that has the following roles and privs
OBJ     WRITE,READ ON DIRECTORY "SYS.TEMPDATA"
PRV     CREATE PROCEDURE
PRV     CREATE VIEW
PRV     UNLIMITED TABLESPACE
ROL     CONNECT
ROL     EXP_FULL_DATABASE
ROL     IMP_FULL_DATABASE
ROL     RESOURCE
But when I login as USER2, I can access, update and delete rows from USER1. Thats not what I want. I checked the user_tab_privs_recd and nothing shows up there. How come User2 has privileges to update/modify USER1 tables? By just having a public synonym that shouldnt be the case.
I dont think 'Grant all on tablename to public' has been given.
eg. I have table EMP in USER1
s
elect * from dba_tab_privs where table_name = 'EMP'
GRANTEE     OWNER     TABLE_NAME     GRANTOR     PRIVILEGE     GRANTABLE     HIERARCHY
USER1_READONLY     USER1     EMP     USER1     SELECT     NO     NO
ABC     USER1     EMP     USER1     SELECT     YES     NO
CDE     USER1     EMP     USER1     SELECT     YES     NO
ZZZ_READONLY     ZZZ     EMP     ZZZ     SELECT     NO     NO
Any ideas? I am confused, because since USER1_READONLY is not granted to USER2, even with public synonym, USER2 should NOT have access to read. But USER2 can update/delete and perform on USER1.EMP
Thanks

Answer 1

Hello,
But when I login as USER2, I can access, update and delete rows from USER1. The Role EXP_FULL_DATABASE has the Privilege System SELECT ANY TABLE:
SQL> select * from dba_sys_privs
  2  where grantee='EXP_FULL_DATABASE';
GRANTEE                        PRIVILEGE                                ADM
EXP_FULL_DATABASE              READ ANY FILE GROUP                      NO
EXP_FULL_DATABASE              RESUMABLE                                NO
EXP_FULL_DATABASE              EXECUTE ANY PROCEDURE                    NO
EXP_FULL_DATABASE              EXECUTE ANY TYPE                         NO
EXP_FULL_DATABASE              SELECT ANY TABLE                         NO
EXP_FULL_DATABASE              ADMINISTER SQL MANAGEMENT OBJECT         NO
EXP_FULL_DATABASE              ADMINISTER RESOURCE MANAGER              NO
EXP_FULL_DATABASE              BACKUP ANY TABLE                         NO
EXP_FULL_DATABASE              CREATE SESSION                           NO
EXP_FULL_DATABASE              SELECT ANY SEQUENCE                      NO
EXP_FULL_DATABASE              CREATE TABLE                             NO
11 ligne(s) sÚlectionnÚe(s).It may explain why USER2 can Select rows from Tables of USER1.
The Role IMP_FULL_DATABASE has the Privileges System DELETE ANY TABLE and UPDATE ANY TABLE. So also it may explain why USER2 can Delete and Update rows from Tables of USER1.
Hope this help.
Best regards,
Jean-Valentin
Edited by: Lubiez Jean-Valentin on Apr 4, 2011 5:44 PM