{ "date": "2014-11-26T18:18:29", "slug": "12c-privilege-analysis-rocks", "link": "https://www.dbi-services.com/blog/12c-privilege-analysis-rocks/", "title": { "rendered": "Oracle 12c privilege analysis rocks" }, "content": { "rendered": "

By Franck Pachot

\n

.
\n12c came with a very nice feature: privilege analysis. You don’t know which privileges are required? then just grant DBA, run your application, and check which minimal privileges are needed. And today, I’ve discovered how it is very powerful: you can even see privileges used internally, even when not done by SQL, and even not documented.

\n

It starts like that, with a question from Vladimir Sitnikov (who publishes very interesting stuff from his twitter account) in the tone of a challenge:

\n

@FranckPachot Ok, ace. Do you think dbms_utility.get_parameter_value requires special grants (e.g. in current 11gR2)?

\n

— Vladimir Sitnikov (@VladimirSitnikv) November 26, 2014

\n

So I got to the doc which has a special security model for some functions but nothing about get_parameter_value.

\n

Then I created a simple user with only CREATE SESSION privilege and got:

\n
SQL> drop user TEST;\nUser dropped.\nSQL> grant create session to TEST identified by TEST;\nGrant succeeded.\nSQL> connect TEST/TEST\nConnected.\nSQL> variable i number\nSQL> variable s varchar2(1000)\nSQL> variable t number\nSQL> exec :t:=DBMS_UTILITY.GET_PARAMETER_VALUE('NLS_LENGTH_SEMANTICS',:i,:s);\nBEGIN :t:=DBMS_UTILITY.GET_PARAMETER_VALUE('NLS_LENGTH_SEMANTICS',:i,:s); END;\n*\nERROR at line 1:\nORA-01031: insufficient privileges\nORA-06512: at \"SYS.DBMS_UTILITY\", line 140\nORA-06512: at line 1\n\n
\n

So, which privileges do you need? Let’s try the 12c privilege analysis:

\n
SQL> grant dba to TEST;\nGrant succeeded.\n\nSQL> connect / as sysdba\nConnected.\n\nSQL> exec dbms_privilege_capture.create_capture (name=>'demo',type =>dbms_privilege_capture.g_role,roles=>role_name_list('DBA'));\nPL/SQL procedure successfully completed.\n\nSQL> exec dbms_privilege_capture.enable_capture (name=>'demo');\nPL/SQL procedure successfully completed.\n\nSQL> connect TEST/TEST\nConnected.\n\nSQL> exec :t:=dbms_utility.get_parameter_value('NLS_LENGTH_SEMANTICS',:i,:s);\nPL/SQL procedure successfully completed.\n\nSQL> print s\n\nS\n--------------------------------------------------------------\nBYTE\n\nSQL> connect / as sysdba\nConnected.\n\nSQL> exec dbms_privilege_capture.disable_capture(name=>'demo');\nPL/SQL procedure successfully completed.\n\nSQL> exec dbms_privilege_capture.generate_result(name=>'demo');\nPL/SQL procedure successfully completed.\n\nSQL> select object_owner,object_name,obj_priv from dba_used_objprivs ;\n\nOBJECT_OWN OBJECT_NAME     OBJ_PRIV\n---------- --------------- ----------\nSYS        V_$PARAMETER    SELECT\n\nSQL> select path from dba_used_objprivs_path ;\n\nPATH\n--------------------------------------------------------------\nGRANT_PATH('TEST', 'DBA', 'EXP_FULL_DATABASE', 'SELECT_CATALOG_ROLE')\nGRANT_PATH('TEST', 'DBA', 'EM_EXPRESS_ALL', 'EM_EXPRESS_BASIC', 'SELECT_CATALOG_ROLE')\nGRANT_PATH('TEST', 'DBA', 'DATAPUMP_IMP_FULL_DATABASE', 'EXP_FULL_DATABASE', 'SELECT_CATALOG_ROLE')\nGRANT_PATH('TEST', 'DBA', 'DATAPUMP_EXP_FULL_DATABASE', 'EXP_FULL_DATABASE', 'SELECT_CATALOG_ROLE')\nGRANT_PATH('TEST', 'DBA', 'IMP_FULL_DATABASE', 'SELECT_CATALOG_ROLE')\nGRANT_PATH('TEST', 'DBA', 'DATAPUMP_IMP_FULL_DATABASE', 'IMP_FULL_DATABASE', 'SELECT_CATALOG_ROLE')\nGRANT_PATH('TEST', 'DBA', 'SELECT_CATALOG_ROLE')\n\nSQL> exec dbms_privilege_capture.drop_capture (name=>'demo');\nPL/SQL procedure successfully completed.\n\n
\n

I’ve granted the DBA privilege and have run the privilege analysis capture on that role while calling the function. And bingo: you need to be granted SELECT on V_$PARAMETER (which come into DBA role through the SELECT_CATALOG_ROLE) … which sounds legitimate as the goal is to get a parameter value.

\n

But do you know what? DBMS_UTILITY.GET_PARAMETER_VALUE do not execute any select statement. That behavior is documented in that package for other function, but not for the GET_PARAMETER_VALUE one:

\n
Rem The dbms_utility package is run-as-caller (psdicd.c) only for\nRem its name_resolve, compile_schema, analyze_schema, wait_on_pending_dml,\nRem and expand_sql_text procedures. This package is not run-as-caller\nRem w.r.t. SQL (psdpgi.c) so that the SQL works correctly (runs as\nRem SYS). The privileges are checked via dbms_ddl.
\n

 

\n

That function calls a C function (KSPGPNICD) so we don’t know what happens behind. If you sql_trace it, you don’t see anything about V_$PARAMETER.

\n

But privilege analysis show the required privileges anyway, and that rocks.

\n", "protected": false } }