1

I'm trying to bring my systems in compliance with a certain set of standards. One of them in confirming that the Oracle default behavior of allowing users to grant and revoke privileges to objects they own is still active. I have no idea how this would even be disabled in the first place, but I'm trying to figure out what evidence I can provide that it is still active other than "this is default behavior of Oracle." Is there a way to confirm this in views like dba_tab_privs or something?

Any assistance would be appreciated. Let me know if you need me to clarify.

3
  • 1
    Your company wants you to test the default functionality of the Oracle database? That would be a challenge from me. Sounds like a waste of T&M.
    – Jacob H
    Jun 9, 2017 at 17:50
  • 2
    It isn't just "the default behavior", it's the only behavior. Owners always have full control on their own objects (including grants and revokes on those objects). That's why separation of container schemas from accounts that login to the database is so key to database security. Jun 12, 2017 at 13:54
  • This was basically my understanding as well. A waste of time and a silly check for behavior that can't possibly be changed. Thank you both. To the powers that be, this question can be closed. Jun 14, 2017 at 18:55

1 Answer 1

0

It isn't just "the default behavior", it's the only behavior. Owners always have full control on their own objects (including grants and revokes on those objects). That's why separation of container schemas from accounts that login to the database is so key to database security.

Disclaimer The original answer was posted as a comment by @KrisJohnston

Addition

There is a slight twist to the answer in that the permissions can be changed so that the owner can longer modify his own objects, BUT the owner is then no longer the owner. This is a loss of ownership for the original owner.

This can be achieved using the following technique:

How to change an Oracle table owner

create table bill.emp as select * from scott.emp;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.