XA errors and compliance

Question

I had extensive XA transaction errors and I found on Metalink Bug No.3979190 which resolved my issues partially. I still see this errors in the log, but I'm able to open and work with the application.
I'm looking for a security advise. The solution provided from Metalink includes the following grants to public:
grant select on v$xatrans$ to public;
grant select on pending_trans$ to public;
grant select on dba_2pc_pending to public;
grant select on dba_pending_transactions to public;
grant execute on dbms_system to <user_name>;
I was wondering if this will be acceptable for the compliance regulations like Hippa or SOX. I'm afraid that there will be an auditing issue with them.
Thanks a lot, mj

Answer 1

The $ objects hold largely transient system internal data. I don't see why there should be any compliance issues there.
Grant EXECUTE on DBMS_SYSTEM is more troubling from a database security point of view. It has some pretty powerful functions in there that can wreak havoc in your system if used maliciously or just carelessly. I would be inclined to find out precisely which functions where required and create a wrapper for just those functions or, if that's not possible, make sure that the user account is not one used by real people. Of course, doing that might necessitate some radical overhaul of your system architecture.
Cheers, APC