On May 12, 9:30=A0am, "fitzjarr...@[EMAIL PROTECTED]
" <orat...@[EMAIL PROTECTED]
> wrote:
> Comments embedded.
>
> On May 12, 8:03=A0am, maxim2k <maxi...@[EMAIL PROTECTED]
> wrote:
>
> > Hi,
>
> > I manage an Oracle Database 10g R2 on Red Hat Enterprise Linux 4, the
> > server is shared between a few customers: each customer has access
> > (CONNECT and RESOURCE priveges) to his own schema only, he cannot
access=
> > other customers objects.
>
> I can only presume this access is through the schema owner. =A0Is this
> the ONLY account accessing this users objects?
>
>
>
> > One of our customers just asked EXECUTE privilege on the dbms_fga
packag=
e.
>
> Which should not be an issue. =A0My question is this: if there is only
> ONE user account which =A0can access these user objects what good does
> having execute privilege on dbms_fga provide? =A0This is used to provide
> Fine-Grained Access (fga) to database objects based upon a user id.
> If only ONE user id accesses these objects I can see no purpose in
> granting access to this package.
>
> > I'm new to this package and I'm not sure what would be the
consequences
> > of such grant.
>
> None, really, as normally it restricts/audits user access to objects
> not owned by that user.
>
> > Can I safely grant that to the customer in question without
compromising=
> > the security of other customers data on the shared server?
>
> Certainly, however I see little, if any, benefit to this if my
> understanding of this configuration (one user account per customer) is
> correct.
>
> > Thanks.
>
> David Fitzjarrell
To add to what David posted ask the customer what he or she intends to
do. It the customer application p***** in the 'real' user then the
customer may be trying to capute who really performed a change or may
actually want to use the dbms_rls package.
Personally I do not think customers should have the ability to create
objects in a production environment. If this is a valid activity for
the application then I would want the object creation handled via a
package referenced via a provided screen interface.
HTH -- Mark D Powell --
|
