3. Assigning Privileges and Granting Permissions

A subject privilege defines the type of operations permissible in a user session. Subject privileges are assigned to a user (subject).

Subject privileges are typically assigned when a user object is created or modified. Subject privileges can also be assigned to roles, as discussed in Groups and Roles.

To set or change subject privileges for a user, you must have the maintain_users privilege.

IMPORTANT! Subject privileges allow many trusted operations to be performed. Therefore, assign privileges with care, especially the Security privilege.

The subject privileges are as follows:

Enables the user to control what information is written to the security audit log

Enables the user to perform various user-related functions, such as creating users and roles

Enables the user to perform security-related operations, including impersonating other users, and to avoid certain security checks, such as database privilege checks

Allows the user to see masked columns without masking, to use the MASK_COLUMN() function in views, and to use COPY INTO when a table contains columns marked as MASKED

The Auditor privilege allows a user to obtain information from the audit log.

A user with this privilege can:

• Register the audit log file to a virtual table using the REGISTER TABLE statement (or perform the equivalent operation in Actian Director or VDBA).

• Remove the registration for an audit log file using the REMOVE TABLE statement (or perform the equivalent operation in Actian Director or VDBA).

• Obtain the audit log file name by calling dbmsinfo(‘security_audit_log’).

The Change_Password privilege lets the user change his password (but not those of others).

The createdb privilege gives the user the ability to create databases.

This privilege is required to use the createdb system command or to use the equivalent operation in Actian Director or Visual DBA.

The maintain_audit privilege allows a user to manage auditing features, including determining the security audit activity level for profiles, users, and roles, and the ability to turn security auditing on and off.

The maintain_audit privilege is typically assigned to the system administrator, the database administrator, or a separate security administrator.

A user with this privilege can:

• Enable or disable security auditing (using the ENABLE and DISABLE SECURITY_AUDIT statements or the equivalent operations in Actian Director or VDBA).

• Change the current audit state (using the ALTER SECURITY_AUDIT statement or the equivalent operation in Actian Director or VDBA).

• Determine the security audit activity level when working with profiles, users, and roles (by specifying the SECURITY_AUDIT clause on ALTER/CREATE PROFILE, ALTER/CREATE USER, and ALTER/CREATE ROLE statements, or using Actian Director or VDBA).

The maintain_locations privilege allows a user to control the allocation of disk space, create new locations or allow new locations to be created, and allow existing locations to be modified or removed.

This privilege is needed to issue the CREATE, ALTER, and DROP LOCATION statements (or to perform the equivalent operations on location objects in Actian Director or VDBA).

The maintain_users privilege allows a user to perform various user-related functions.

• Maintain profiles (using CREATE/ALTER/DROP PROFILE statements or the equivalent operations in Actian Director or VDBA).

• Maintain users (using CREATE/ALTER/DROP USER statements or the equivalent operations in Actian Director or VDBA).

• Maintain groups (using CREATE/ALTER/DROP GROUP statements or the equivalent operations in Actian Director or VDBA).

• Maintain roles (using CREATE/ALTER/DROP ROLE statements or the equivalent operations in Actian Director or VDBA).

A user who is responsible for running Vector requires the Operator privilege.

These system commands can alternatively be run through the Remote Command (rmcmd) Server by a (client) user who has the rmcmd privileges rather than the Operator privilege (assuming that the user who launched rmcmd on the server side has the Operator privileges). The sysmod command, however, requires the client user to have the security privilege or be the user who launched rmcmd on the server side.

The Security privilege allows a user to monitor the security of the system and the activities of its users. The Security privilege and all other privileges are automatically bestowed on the installation owner.

• Impersonate other users (using the ‑u flag on commands or performing the equivalent using Actian Director or the Users branch of the Virtual Nodes toolbar in VDBA).

• Connect to any database with unlimited database privileges. (In effect, database privileges are not enforced for users with the Security privilege.)

• Configure database and installation security alarms (using CREATE/DROP SECURITY_ALARM statements or the equivalent operations in Actian Director or VDBA).

IMPORTANT! The Security privilege is powerful because it allows the holder to impersonate any other user. At least one user with the Security privilege is required, but the privilege can be restricted as tightly as possible so that your system security is not compromised.

Note: The security privilege does not allow a user to bypass granted permissions on a database object; unless permission is granted to the user they are impersonating, they will not be able to access the object.

Note: Selecting from IMA tables requires Security privilege; otherwise 0 rows are returned.

The Trace privilege allows a user to perform tracing, troubleshooting, and debugging operations. It enables the user to set the debugging trace flags using the following statements:

The Trace privilege permits access to possibly confidential information, so it should be enabled for the installation owner or security administrator only.

The UNMASK privilege allows the user to:

• Use the MASK_COLUMN() function in views to control access to and the presentation of masked data

In addition to assigning subject privileges to a user, Vector lets you define a default set of subject privileges that will be available at session startup.

In addition, any privilege assigned to the user can be added or dropped during the life of the session; this capability effectively applies the principle of least privilege.

The principle of least privilege asserts that a subject must have the minimum privileges required to perform an operation, and that these privileges must be active for the minimum amount of time necessary to perform that operation.

Thus, a session has three sets of privileges associated with it:

• The default privilege set contains those privileges that become active when a connection to Vector is initiated.

• The working privilege set contains those privileges that are active at any particular time (at session startup, the working privilege set is equivalent to the default privilege set).

• The maximum privilege set contains all privileges that a particular user is allowed to have.

The working privilege set is determined during the life of the session, when privileges can be made active as necessary to allow a privileged operation to be performed and made inactive on completion of the task.

The working privilege set is specified using the SET SESSION statement. Using SET SESSION, you can:

In VDBA, the maximum privilege set consists of all the privileges enabled in the Users column of the Create User or Alter User dialog. The default privilege set, which is a subset of the maximum privilege set, consists of all the privileges enabled in the Default column of the Create User or Alter User dialog.