MINI MINI MANI MO
Rem Copyright (c) 2002, 2017, Oracle and/or its affiliates.
Rem All rights reserved.
Rem
Rem NAME
Rem sdotpwgo.sql - Remove "To Public With Grant Option"
Rem
Rem DESCRIPTION
Rem
Rem NOTES
Rem
Rem BEGIN SQL_FILE_METADATA
Rem SQL_SOURCE_FILE: sdo/admin/sdotpwgo.sql
Rem SQL_SHIPPED_FILE: md/admin/sdotpwgo.sql
Rem SQL_PHASE: SDOTPWGO
Rem SQL_STARTUP_MODE: NORMAL
Rem SQL_IGNORABLE_ERRORS: NONE
Rem SQL_CALLING_FILE: sdo/admin/sdodbmig.sql
Rem END SQL_FILE_METADATA
Rem
Rem MODIFIED (MM/DD/YY)
Rem rjanders 11/06/17 - Add more exception handler pragmas
Rem sravada 04/18/17 - more fixes for persistent objects
Rem rjanders 03/09/17 - Add missing SQL_FILE_METADATA information
Rem rjanders 03/07/17 - Only check "persistent" spatial objects
Rem rjanders 01/09/17 - Remove TABLE UPGRADE (causes issues on CDB/PDB)
Rem rjanders 01/01/17 - #25293022: Ignore revoke if tables already exist
Rem rjanders 08/18/15 - Created
Rem
Rem Regarding bug#21825604 (Remove WITH GRANT OPTION from PUBLIC),
Rem Srinidhi Kayoor offers the following explanation why WITH GRANT OPTION
Rem SHOULD NOT (repeat SHOULD NOT) be granted to the user PUBLIC:
Rem
Rem The issue is with granting the privilege to PUBLIC using
Rem WITH GRANT OPTION. Consider at the testcase below:
Rem
Rem ==========================================================================
Rem set echo on
Rem set feedback 1
Rem spool abc2.log
Rem column owner format a10
Rem column table_name format a10
Rem column grantee format a10
Rem column grantor format a10
Rem column privilege format a10
Rem column grantable format a10
Rem
Rem connect sys/********* as sysdba
Rem set pages 3000
Rem
Rem drop function MDSYS.test;
Rem
Rem -- Explicit alter session
Rem -- alter session set current_schema=MDSYS;
Rem create or replace function MDSYS.test return number
Rem IS
Rem begin
Rem return 10;
Rem end;
Rem /
Rem
Rem grant execute on MDSYS.TEST to PUBLIC with grant option;
Rem grant execute on MDSYS.TEST to PUBLIC with grant option;
Rem grant execute on MDSYS.TEST to PUBLIC with grant option;
Rem
Rem -- Returns two rows. Bug
Rem SELECT owner, table_name, grantee, grantor,privilege, grantable
Rem FROM DBA_TAB_PRIVS where table_name='TEST' and owner='MDSYS';
Rem
Rem SELECT owner, table_name, grantee, grantor,privilege, grantable
Rem FROM DBA_TAB_PRIVS where table_name='TEST' and owner='SYS';
Rem
Rem ==========================================================================
Rem
Rem The behavior shown here is correct. The reason is that of the order in
Rem which the grant is made:
Rem 1 Grantor should be the owner of the object.
Rem 2 Grantor (including the roles which includes PUBLIC by default,
Rem granted to that user) should have the privilege granted on the
Rem object with WITH GRANT OPTION.
Rem 3 Grantor should have the GRANT ANY OBJECT PRIVILEGE system
Rem privilege.
Rem
Rem Here, in the testcase, the grantor would be SYS and the object (TEST)
Rem owner would be MDSYS.
Rem
Rem For the first grant, the grant driver goes by the order.
Rem 1 SYS is not the owner of the object TEST.
Rem 2 SYS has not been granted the object privilege, EXECUTE on TEST
Rem with WITH GRANT OPTION.
Rem 3 SYS has GRANT ANY OBJECT PRIVILEGE system privilege
Rem *** Satisfies the criteria ***
Rem
Rem For using GRANT ANY OBJECT PRIVILEGE, the grantor will be changed
Rem to the owner of the object while persisting the grant to the dictionary.
Rem This is done to make the life of REVOKE easy and is a different story.
Rem
Rem So now after the first grant statement, the grant which would be
Rem persisted in dictionary would have grantor as MDSYS and grantee as
Rem PUBLIC with WITH GRANT OPTION.
Rem
Rem For the second grant, the grant driver again goes by the order.
Rem 1 SYS is not the owner of the object TEST.
Rem 2 SYS (or rather PUBLIC which is default role for all users) has
Rem been granted object privilege with WITH GRANT OPTION.
Rem *** Satisfies the criteria. ***
Rem 3 Doesn't need to check for GRANT ANY OBJECT PRIVILEGE.
Rem
Rem For using grants made with object privilege with WITH GRANT OPTION,
Rem the grantor will be the current user when the grant is persisted to
Rem the dictionary.
Rem
Rem So now after the second grant statement, the grant which would be
Rem persisted in dictionary would have grantor as SYS (current user) and
Rem grantee as PUBLIC with WITH GRANT OPTION. This is allowed as privilege
Rem on an object can be made by multiple grantors to the same grantee.
Rem When the privilege is revoked from one particular grantor, only those
Rem privileges granted by that grantor would be revoked and the rest would
Rem still be applicable.
Rem
Rem Hence in this testcase after the second grant, DBA_TAB_PRIVS would
Rem start showing two rows for the same object.
Rem
Rem The solution for this would be to remove the WITH GRANT OPTION clause
Rem in the grant statement. This clause is not really necessary as PUBLIC
Rem would be default role for all the users and once the privilege has been
Rem granted to PUBLIC, all the users would get it. There is no need for
Rem granting the privilege again to another user which is the main purpose
Rem of WITH GRANT OPTION.
Rem
Rem ********************************************************************
Rem #16473696: Indicate Oracle-Supplied object
@@?/rdbms/admin/sqlsessstart.sql
Rem ********************************************************************
Alter session set current_schema=MDSYS;
-- This procedure logs "vital" messages to the tracefile
CREATE OR REPLACE PROCEDURE ksdwrf(
str varchar2,
trace boolean default true) IS
BEGIN
if ( trace ) then
SYS.DBMS_SYSTEM.KSDWRT(SYS.DBMS_SYSTEM.TRACE_FILE, str);
end if;
END;
/
SHOW ERRORS
-- This procedure revokes the WITH GRANT OPTION from PUBLIC
-- and then re-grants the EXECUTE privilege to PUBLIC.
CREATE OR REPLACE PROCEDURE RevokeWithGrantOption(
objstr IN VARCHAR2)
AS
stmt varchar2(4000);
stmt1 varchar2(4000);
objnam varchar2(270);
type cursor_type is REF CURSOR;
query_crs cursor_type;
object_dependents exception;
pragma exception_init(object_dependents, -02344);
package_not_found exception;
pragma exception_init(package_not_found, -04042);
only_select exception;
pragma exception_init(only_select, -02205);
BEGIN
if ( objstr is not NULL ) then
objnam := '"MDSYS".' || SYS.DBMS_ASSERT.enquote_name(nls_upper(objstr));
-- Revoke the WITH GRANT OPTION on "object" from PUBLIC
stmt := 'REVOKE EXECUTE ON ' || objnam || ' FROM PUBLIC';
begin
execute immediate stmt;
exception
when object_dependents then NULL;
when package_not_found then NULL;
when only_select then NULL;
when others then
ksdwrf('REVOKE FROM PUBLIC on ' || objnam || ' failed');
ksdwrf('ERROR=' || SQLERRM);
end;
-- Grant EXECUTE on "object" to PUBLIC
stmt := 'GRANT EXECUTE ON ' || objnam || ' TO PUBLIC';
begin
execute immediate stmt;
exception when others then
ksdwrf('GRANT TO PUBLIC on ' || objnam || ' failed');
ksdwrf('ERROR=' || SQLERRM);
end;
else
-- #25293022: Check if ANY non-MDSYS tables exist that contain this type
-- This is necessary to avoid requiring customers have to "upgrade" their
-- existing tables that have columns defined using this object type
-- There is an RDBMS bug that can cause the SDO_GEOMETRY tables to become invalid if
-- the grants are revoked on the underlying SDO_POINT_TYPE type.
-- same issue can happen for any other type that includes another type
stmt := 'SELECT column_value "DATA_TYPE" ' ||
'FROM TABLE( SYS.ODCIVARCHAR2LIST( ' ||
' ''SDO_EDGE_ARRAY'', ' ||
' ''SDO_GEOMETRY'', ''SDO_GEORASTER'', ' ||
' ''SDO_LIST_TYPE'', ''SDO_NUMBER_ARRAY'', ' ||
' ''SDO_RASTER'', ' ||
' ''SDO_TOPO_GEOMETRY'', ' ||
' ''SDO_PC'', ''SDO_TIN'')) ' ||
'MINUS ' ||
'SELECT distinct data_type FROM sys.dba_tab_columns ' ||
'WHERE owner != ''MDSYS'' ' ||
'AND data_type_owner in (''MDSYS'' , ''PUBLIC'') ' ||
'AND data_type in ( ''SDO_DIM_ARRAY'', ''SDO_EDGE_ARRAY'', ' ||
' ''SDO_GEOMETRY'', ''SDO_GEORASTER'', ' ||
' ''SDO_LIST_TYPE'', ''SDO_NUMBER_ARRAY'', ' ||
' ''SDO_POINT_TYPE'', ''SDO_RASTER'', ' ||
' ''SDO_TGL_OBJECT'', ''SDO_TGL_OBJECT_ARRAY'', ' ||
' ''SDO_TOPO_OBJECT'', ''SDO_TOPO_GEOMETRY'', ' ||
' ''SDO_PC'', ''SDO_TIN'' ) ' ||
'AND substr(table_name, 1, 4) != ''BIN$'' ' ||
'GROUP BY data_type';
open query_crs for stmt;
loop
fetch query_crs into objnam;
exit when query_crs%NOTFOUND;
-- Revoke the WITH GRANT OPTION on "object" from PUBLIC
stmt1 := 'REVOKE EXECUTE ON ' || objnam || ' FROM PUBLIC';
begin
execute immediate stmt1;
exception
when object_dependents then NULL;
when package_not_found then NULL;
when only_select then NULL;
when others then
ksdwrf('REVOKE FROM PUBLIC on ' || objnam || ' failed');
ksdwrf('ERROR=' || SQLERRM);
end;
-- Grant EXECUTE on "object" to PUBLIC
stmt1 := 'GRANT EXECUTE ON ' || objnam || ' TO PUBLIC';
begin
execute immediate stmt1;
exception when others then
ksdwrf('GRANT TO PUBLIC on ' || objnam || ' failed');
ksdwrf('ERROR=' || SQLERRM);
end;
end loop;
close query_crs;
end if;
END;
/
SHOW ERRORS
-- set serveroutput on
-- Execute the GRANT conversion for the "persistent" objects
-- execute RevokeWithGrantOption(NULL);
-- Execute the GRANT conversion for the "secondary" objects
execute RevokeWithGrantOption('EPSG_PARAM');
execute RevokeWithGrantOption('EPSG_PARAMS');
execute RevokeWithGrantOption('MBRCOORDLIST');
execute RevokeWithGrantOption('SDO_GEOR_COLORMAP');
execute RevokeWithGrantOption('SDO_GEOR_GCP');
execute RevokeWithGrantOption('SDO_GEOR_GCPGEOREFTYPE');
execute RevokeWithGrantOption('SDO_GEOR_GCP_COLLECTION');
execute RevokeWithGrantOption('SDO_GEOR_GRAYSCALE');
execute RevokeWithGrantOption('SDO_GEOR_HISTOGRAM');
execute RevokeWithGrantOption('SDO_GEOR_METADATA');
execute RevokeWithGrantOption('SDO_GEOR_SRS');
-- execute RevokeWithGrantOption('SDO_MBR');
execute RevokeWithGrantOption('SDO_NUMBER_ARRAYSET');
execute RevokeWithGrantOption('SDO_RANGE');
execute RevokeWithGrantOption('SDO_RANGE_ARRAY');
execute RevokeWithGrantOption('SDO_RASTERSET');
execute RevokeWithGrantOption('SDO_REGAGGR');
execute RevokeWithGrantOption('SDO_REGAGGRSET');
execute RevokeWithGrantOption('SDO_REGION');
execute RevokeWithGrantOption('SDO_REGIONSET');
execute RevokeWithGrantOption('SDO_ROWIDPAIR');
execute RevokeWithGrantOption('SDO_ROWIDSET');
execute RevokeWithGrantOption('SDO_SMPL_GEOMETRY');
execute RevokeWithGrantOption('SDO_SRID_CHAIN');
execute RevokeWithGrantOption('SDO_STRING2_ARRAYSET');
execute RevokeWithGrantOption('SDO_TFM_CHAIN');
execute RevokeWithGrantOption('SDO_VPOINT_TYPE');
-- execute RevokeWithGrantOption('SDO_STRING_ARRAY');
-- execute RevokeWithGrantOption('ST_DOUBLE_PRECISION_ARRAY');
-- execute RevokeWithGrantOption('ST_CIRCULARSTRING');
-- execute RevokeWithGrantOption('ST_COMPOUNDCURVE');
-- execute RevokeWithGrantOption('ST_CURVE');
-- execute RevokeWithGrantOption('ST_CURVEPOLYGON');
-- execute RevokeWithGrantOption('ST_CURVE_ARRAY');
-- execute RevokeWithGrantOption('ST_GEOMCOLLECTION');
-- execute RevokeWithGrantOption('ST_GEOMETRY');
-- execute RevokeWithGrantOption('ST_GEOMETRY_ARRAY');
-- execute RevokeWithGrantOption('ST_LINESTRING');
-- execute RevokeWithGrantOption('ST_LINESTRING_ARRAY');
-- execute RevokeWithGrantOption('ST_MULTICURVE');
-- execute RevokeWithGrantOption('ST_MULTILINESTRING');
-- execute RevokeWithGrantOption('ST_MULTIPOINT');
-- execute RevokeWithGrantOption('ST_MULTIPOLYGON');
-- execute RevokeWithGrantOption('ST_MULTISURFACE');
-- execute RevokeWithGrantOption('ST_POINT');
-- execute RevokeWithGrantOption('ST_POLYGON');
-- execute RevokeWithGrantOption('ST_POLYGON_ARRAY');
-- execute RevokeWithGrantOption('ST_Point_Array');
-- execute RevokeWithGrantOption('ST_SURFACE');
-- execute RevokeWithGrantOption('ST_SURFACE_ARRAY');
execute RevokeWithGrantOption('TFM_PLAN');
execute RevokeWithGrantOption('TMP_COORD_OPS');
execute RevokeWithGrantOption('locator_within_distance');
execute RevokeWithGrantOption('map_dca_list_type');
execute RevokeWithGrantOption('map_list_type');
execute RevokeWithGrantOption('map_name_list_type');
execute RevokeWithGrantOption('sdo_anyinteract');
execute RevokeWithGrantOption('sdo_contains');
execute RevokeWithGrantOption('sdo_coveredby');
execute RevokeWithGrantOption('sdo_covers');
execute RevokeWithGrantOption('sdo_dummy');
execute RevokeWithGrantOption('sdo_dummy_function');
execute RevokeWithGrantOption('sdo_dummy_function_v2');
execute RevokeWithGrantOption('sdo_dummy_v2');
execute RevokeWithGrantOption('sdo_equal');
execute RevokeWithGrantOption('sdo_filter');
execute RevokeWithGrantOption('sdo_inside');
execute RevokeWithGrantOption('sdo_int2_filter');
execute RevokeWithGrantOption('sdo_int2_relate');
execute RevokeWithGrantOption('sdo_int_filter');
execute RevokeWithGrantOption('sdo_int_relate');
execute RevokeWithGrantOption('sdo_keywordarray');
execute RevokeWithGrantOption('sdo_nn');
execute RevokeWithGrantOption('sdo_nn_distance');
execute RevokeWithGrantOption('sdo_on');
-- execute RevokeWithGrantOption('sdo_orgscl_type');
execute RevokeWithGrantOption('sdo_overlapbdydisjoint');
execute RevokeWithGrantOption('sdo_overlapbdyintersect');
execute RevokeWithGrantOption('sdo_overlaps');
execute RevokeWithGrantOption('sdo_relate');
execute RevokeWithGrantOption('sdo_rtree_filter');
execute RevokeWithGrantOption('sdo_rtree_relate');
execute RevokeWithGrantOption('sdo_touch');
execute RevokeWithGrantOption('sdo_within_distance');
-- execute RevokeWithGrantOption('sdo_pc_blk');
-- execute RevokeWithGrantOption('sdo_pc_blk_type');
execute RevokeWithGrantOption('sdo_rdf_term');
execute RevokeWithGrantOption('sdo_rdf_term_list');
-- execute RevokeWithGrantOption('sdo_rdf_triple');
-- execute RevokeWithGrantOption('sdo_rdf_triple_s');
-- execute RevokeWithGrantOption('sdo_tin_blk');
-- execute RevokeWithGrantOption('sdo_tin_blk_type');
execute RevokeWithGrantOption('sdoridlist');
execute RevokeWithGrantOption('sdoridtab');
execute RevokeWithGrantOption('varchar2_ntt');
-- set serveroutput off
DROP PROCEDURE RevokeWithGrantOption;
DROP PROCEDURE ksdwrf;
Rem ********************************************************************
Rem #16473696: Indicate Oracle-Supplied object
@?/rdbms/admin/sqlsessend.sql
Rem ********************************************************************
OHA YOOOO