I was wondering if it is safe to grant select rights to syscat.schemata to users on a DB2 database? What could go "wrong"?

Some tool like DataGrip and DBeaver cannot load connection schemas because of this missing rights. Others tools like AQT or SquirrelSQL load schemas that they see with not problem.

I am not really at home in DB2 environment.

  • @mustaccio It has come to my attention that grants were removed because of PCI DSS hardening. Please post your comment as answer and I will accept it. – RokX Mar 26 at 11:07

Select privileges on all SYSCAT objects are granted by default to the PUBLIC pseudo-group (unless the database is created as "restrictive"), so you shouldn't have ended up with users not being able to access syscat.schemata unless you or someone before you chose to actively prevent that.

What could go "wrong"?

Users will be able to discover what schemas exist in your database. Obviously this doesn't give them any extra privileges to see or access in any way objects in those schemas. In other words, being able to read syscat.schemata is pretty harmless.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.