Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I created a new database on a SQL Server 2008 R2 instance and a login/user for it. I have set the user to db_owner so he can't view any other databases on that server but he can see and query the master

database. Is there a way to hide/deny permissions for the master database? Are there any possible vulnerabilities if I leave him to query the master database or is there a way to deny him access to the master database?

share|improve this question
4  
What are you trying to hide from them specifically? Sometimes some access to master is important, e.g. if the user will need to execute certain stored procedures, or query from utility tables that are proliferated in code all over the web (e.g. master.dbo.spt_values). –  Aaron Bertrand Feb 14 at 14:30
    
There will be no need for that. All stored procedures (if any) will be custom regarding that database only. I tried to query the master in some ways and for now I didn't find any information about the other databases that are hidden from that user –  AArmin Feb 14 at 15:09
1  
@AArmin The views and tables in master have select permission granted to public. When a user is not explicitly granted or denied permissions, then the effective permission is inherited from public. I agree with Aaron's point - what exactly you want to hide from the users ? You can explicitly deny permissions to users using dynamic SQL. –  Kin Aug 5 at 15:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.