11.2.0.3 upgraded from 10.2.0.3 via standard dbua:
SQL> select * from dba_sys_privs
where grantee = 'RESOURCE'; 2
GRANTEE
PRIVILEGE ADM
------------------------------
---------------------------------------- ---
RESOURCE CREATE
TRIGGER NO
RESOURCE CREATE
SEQUENCE NO
RESOURCE CREATE
CLUSTER NO
RESOURCE CREATE
TYPE NO
RESOURCE CREATE
PROCEDURE NO
RESOURCE CREATE
TABLE NO
RESOURCE CREATE
INDEXTYPE NO
RESOURCE CREATE
OPERATOR NO
Original 10.2.0.3:
SQL> select * from dba_sys_privs
where grantee = 'RESOURCE'; 2
GRANTEE
PRIVILEGE ADM
------------------------------
---------------------------------------- ---
RESOURCE CREATE
VIEW NO
RESOURCE CREATE
TRIGGER NO
RESOURCE CREATE
SEQUENCE NO
RESOURCE CREATE
CLUSTER NO
RESOURCE CREATE
TYPE NO
RESOURCE CREATE
PROCEDURE NO
RESOURCE CREATE
TABLE NO
RESOURCE CREATE
INDEXTYPE NO
RESOURCE CREATE
OPERATOR NO
Notice anything missing in the 11.2.0.3 resource role after the
upgrade?
Ah yes, it's a "feature". Like, the size of a bus?
(...patience, Nuno, patience...)
On Wednesday, June 27, 2012 2:35:12 AM UTC+2, Noons wrote:
> 11.2.0.3 upgraded from 10.2.0.3 via standard dbua:
> SQL> select * from dba_sys_privs
> where grantee = 'RESOURCE'; 2
> GRANTEE
> PRIVILEGE ADM
> ------------------------------
> ---------------------------------------- ---
> RESOURCE CREATE
> TRIGGER NO
> RESOURCE CREATE
> SEQUENCE NO
> RESOURCE CREATE
> CLUSTER NO
> RESOURCE CREATE
> TYPE NO
> RESOURCE CREATE
> PROCEDURE NO
> RESOURCE CREATE
> TABLE NO
> RESOURCE CREATE
> INDEXTYPE NO
> RESOURCE CREATE
> OPERATOR NO
> Original 10.2.0.3:
> SQL> select * from dba_sys_privs
> where grantee = 'RESOURCE'; 2
> GRANTEE
> PRIVILEGE ADM
> ------------------------------
> ---------------------------------------- ---
> RESOURCE CREATE
> VIEW NO
> RESOURCE CREATE
> TRIGGER NO
> RESOURCE CREATE
> SEQUENCE NO
> RESOURCE CREATE
> CLUSTER NO
> RESOURCE CREATE
> TYPE NO
> RESOURCE CREATE
> PROCEDURE NO
> RESOURCE CREATE
> TABLE NO
> RESOURCE CREATE
> INDEXTYPE NO
> RESOURCE CREATE
> OPERATOR NO
> Notice anything missing in the 11.2.0.3 resource role after the
> upgrade?
> Ah yes, it's a "feature". Like, the size of a bus?
> (...patience, Nuno, patience...)
It's strange that they took only the CREATE VIEW privilege away... is this some kind of security measure?
> On Wednesday, June 27, 2012 2:35:12 AM UTC+2, Noons wrote:
> > 11.2.0.3 upgraded from 10.2.0.3 via standard dbua:
> > SQL> select * from dba_sys_privs
> > where grantee = 'RESOURCE'; 2
> > GRANTEE
> > PRIVILEGE ADM
> > ------------------------------
> > ---------------------------------------- ---
> > RESOURCE CREATE
> > TRIGGER NO
> > RESOURCE CREATE
> > SEQUENCE NO
> > RESOURCE CREATE
> > CLUSTER NO
> > RESOURCE CREATE
> > TYPE NO
> > RESOURCE CREATE
> > PROCEDURE NO
> > RESOURCE CREATE
> > TABLE NO
> > RESOURCE CREATE
> > INDEXTYPE NO
> > RESOURCE CREATE
> > OPERATOR NO
> > Original 10.2.0.3:
> > SQL> select * from dba_sys_privs
> > where grantee = 'RESOURCE'; 2
> > GRANTEE
> > PRIVILEGE ADM
> > ------------------------------
> > ---------------------------------------- ---
> > RESOURCE CREATE
> > VIEW NO
> > RESOURCE CREATE
> > TRIGGER NO
> > RESOURCE CREATE
> > SEQUENCE NO
> > RESOURCE CREATE
> > CLUSTER NO
> > RESOURCE CREATE
> > TYPE NO
> > RESOURCE CREATE
> > PROCEDURE NO
> > RESOURCE CREATE
> > TABLE NO
> > RESOURCE CREATE
> > INDEXTYPE NO
> > RESOURCE CREATE
> > OPERATOR NO
> > Notice anything missing in the 11.2.0.3 resource role after the
> > upgrade?
> > Ah yes, it's a "feature". Like, the size of a bus?
> > (...patience, Nuno, patience...)
> It's strange that they took only the CREATE VIEW privilege away... is this some kind of security measure?
> Matthias- Hide quoted text -
> - Show quoted text -
For a long time now Oracle has hinted that RESOURCE was not the role
to be granting to people and that explicit grants or other roles
should be used. I suppose this is one way to prod people into
creating their own general-purpose roles for basic privileges.
On Wednesday, June 27, 2012 7:07:24 AM UTC-4, Matthias Hoys wrote:
> On Wednesday, June 27, 2012 2:35:12 AM UTC+2, Noons wrote:
> > 11.2.0.3 upgraded from 10.2.0.3 via standard dbua:
> > SQL> select * from dba_sys_privs
> > where grantee = 'RESOURCE'; 2
> > GRANTEE
> > PRIVILEGE ADM
> > ------------------------------
> > ---------------------------------------- ---
> > RESOURCE CREATE
> > TRIGGER NO
> > RESOURCE CREATE
> > SEQUENCE NO
> > RESOURCE CREATE
> > CLUSTER NO
> > RESOURCE CREATE
> > TYPE NO
> > RESOURCE CREATE
> > PROCEDURE NO
> > RESOURCE CREATE
> > TABLE NO
> > RESOURCE CREATE
> > INDEXTYPE NO
> > RESOURCE CREATE
> > OPERATOR NO
> > Original 10.2.0.3:
> > SQL> select * from dba_sys_privs
> > where grantee = 'RESOURCE'; 2
> > GRANTEE
> > PRIVILEGE ADM
> > ------------------------------
> > ---------------------------------------- ---
> > RESOURCE CREATE
> > VIEW NO
> > RESOURCE CREATE
> > TRIGGER NO
> > RESOURCE CREATE
> > SEQUENCE NO
> > RESOURCE CREATE
> > CLUSTER NO
> > RESOURCE CREATE
> > TYPE NO
> > RESOURCE CREATE
> > PROCEDURE NO
> > RESOURCE CREATE
> > TABLE NO
> > RESOURCE CREATE
> > INDEXTYPE NO
> > RESOURCE CREATE
> > OPERATOR NO
> > Notice anything missing in the 11.2.0.3 resource role after the
> > upgrade?
> > Ah yes, it's a "feature". Like, the size of a bus?
> > (...patience, Nuno, patience...)
> It's strange that they took only the CREATE VIEW privilege away... is this some kind of security measure?
> Matthias
I wish Oracle had treated the role the same way connect was treated, i.e., remove all privileges except create session.
# For a long time now Oracle has hinted that RESOURCE was not the role
to be granting to people and that explicit grants or other roles
should be used.
Bingo ... long time back ... still does not stop one from being
surprised when they finally do something though.
# I suppose this is one way to prod people into creating their own
general-purpose roles for basic privileges.
One could and probably should hypothesize that all user sessions
connecting into the database only be granted roles that do not depend
on any of the oracle created roles.
One could and probably should also contend that DBA and SYSDBA roles
are so unique that granting access to those roles is an exception.
> For a long time now Oracle has hinted that RESOURCE was not the role
> to be granting to people and that explicit grants or other roles
> should be used. I suppose this is one way to prod people into
> creating their own general-purpose roles for basic privileges.
Sure. But last time I looked, it's listed as a valid role in various of their own manuals. I don't give a hoot about "hints" until they make a show in the doco, black on white. Or else we might all start carrying weapons?
This is just SLACK QA, quite frankly. And don't anyone please mention "doco error": that one is a classic...
Mark D Powell wrote,on my timestamp of 28/06/2012 6:17 AM:
> I wish Oracle had treated the role the same way connect was treated, i.e., remove all privileges except create session.
Why mangle it then? Either be done with it, remove it from doco, and make an OFFICIAL note that it MUST not be used, or else stop the bull that it's somehow the dba's fault that Oracle don't know how to handle their own default security.
