Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

We have an application user which has been given read write to the appropriate databases. This user has the ability to query the sys tables by default. I've also heard that there are times when this user needs to be able to obtain a listing of tables and columns that exist in the database. Are there any security risks to having the user have read access to the sys tables?

share|improve this question
add comment

1 Answer 1

up vote 7 down vote accepted

All users have access to sys tables. Giving read access on the database is orthogonal to accessing the sys tables. System catalogs (ie. sys views and tables) have built in security and you cannot grant, deny or revoke read permissions on them. The visibility of entities in system catalogs derives from the permissions granted on the entity itself, not on the system catalog. To give an example, an user can see a row in sys.tables because it has VIEW DEFINITION permission on that table.

This is laso explained in the MSDN:

The visibility of the metadata in catalog views is limited to securables that a user either owns or on which the user has been granted some permission. For more information, see Metadata Visibility Configuration.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.