This is an automated email from the ASF dual-hosted git repository.
pradeep pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new 4da92b1 RANGER-3322: remove grant of public synonym privileges for
oracle db
4da92b1 is described below
commit 4da92b1ad2aaab19d855d6d7215132cf92347454
Author: pradeep <[email protected]>
AuthorDate: Thu Jun 24 18:29:33 2021 +0530
RANGER-3322: remove grant of public synonym privileges for oracle db
---
kms/scripts/dba_script.py | 20 ++++++++++----------
security-admin/db/oracle/xa_audit_db_oracle.sql | 2 --
security-admin/scripts/dba_script.py | 12 ++++++------
3 files changed, 16 insertions(+), 18 deletions(-)
diff --git a/kms/scripts/dba_script.py b/kms/scripts/dba_script.py
index c399de6..14e6ff8 100755
--- a/kms/scripts/dba_script.py
+++ b/kms/scripts/dba_script.py
@@ -429,11 +429,11 @@ class OracleConf(BaseDB):
log("[I] User " +
db_user + " created", "info")
log("[I] Granting
permission to " + db_user, "info")
if is_unix:
- query = get_cmd
+ " -c \; -query 'GRANT CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE
VIEW,CREATE SEQUENCE,CREATE PUBLIC SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace
TO %s;'" % (db_user)
+ query = get_cmd
+ " -c \; -query 'GRANT CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE
VIEW,CREATE SEQUENCE,CREATE TRIGGER,UNLIMITED Tablespace TO %s;'" % (db_user)
jisql_log(query, db_root_password)
ret =
subprocess.call(shlex.split(query))
elif os_name ==
"WINDOWS":
- query = get_cmd
+ " -query \"GRANT CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE
VIEW,CREATE SEQUENCE,CREATE PUBLIC SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace
TO %s;\" -c ;" % (db_user)
+ query = get_cmd
+ " -query \"GRANT CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE
VIEW,CREATE SEQUENCE,CREATE TRIGGER,UNLIMITED Tablespace TO %s;\" -c ;" %
(db_user)
jisql_log(query, db_root_password)
ret =
subprocess.call(query)
if ret == 0:
@@ -528,11 +528,11 @@ class OracleConf(BaseDB):
if ret == 0:
log("[I] Granting permission to " + db_user,
"info")
if is_unix:
- query = get_cmd + " -c \; -query 'GRANT
CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE
PUBLIC SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO %s;'" % (db_user)
+ query = get_cmd + " -c \; -query 'GRANT
CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE
TRIGGER,UNLIMITED Tablespace TO %s;'" % (db_user)
jisql_log(query, db_root_password)
ret =
subprocess.call(shlex.split(query))
elif os_name == "WINDOWS":
- query = get_cmd + " -query \"GRANT
CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE
PUBLIC SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO %s;\" -c ;" % (db_user)
+ query = get_cmd + " -query \"GRANT
CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE
TRIGGER,UNLIMITED Tablespace TO %s;\" -c ;" % (db_user)
jisql_log(query, db_root_password)
ret = subprocess.call(query)
if ret == 0:
@@ -546,18 +546,18 @@ class OracleConf(BaseDB):
sys.exit(1)
else:
logFile("alter user %s DEFAULT Tablespace %s;"
%(db_user, db_name))
- logFile("GRANT CREATE SESSION,CREATE PROCEDURE,CREATE
TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE PUBLIC SYNONYM,CREATE
TRIGGER,UNLIMITED Tablespace TO %s;" % (db_user))
+ logFile("GRANT CREATE SESSION,CREATE PROCEDURE,CREATE
TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE TRIGGER,UNLIMITED Tablespace TO %s;" %
(db_user))
def grant_xa_db_user(self, root_user, db_name, db_user, db_password,
db_root_password, invoke,dryMode):
if dryMode == False:
get_cmd = self.get_jisql_cmd(root_user
,db_root_password)
if is_unix:
- query = get_cmd + " -c \; -query 'GRANT CREATE
SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE PUBLIC
SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO %s;'" % (db_user)
+ query = get_cmd + " -c \; -query 'GRANT CREATE
SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE
TRIGGER,UNLIMITED Tablespace TO %s;'" % (db_user)
jisql_log(query, db_root_password)
ret = subprocess.call(shlex.split(query))
elif os_name == "WINDOWS":
- query = get_cmd + " -query \"GRANT CREATE
SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE PUBLIC
SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO %s;\" -c ;" % (db_user)
+ query = get_cmd + " -query \"GRANT CREATE
SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE
TRIGGER,UNLIMITED Tablespace TO %s;\" -c ;" % (db_user)
jisql_log(query, db_root_password)
ret = subprocess.call(query)
if ret == 0:
@@ -567,15 +567,15 @@ class OracleConf(BaseDB):
log("[E] Granting Oracle user '" + db_user + "'
failed..", "error")
sys.exit(1)
else:
- logFile("GRANT CREATE SESSION,CREATE PROCEDURE,CREATE
TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE PUBLIC SYNONYM,CREATE
TRIGGER,UNLIMITED Tablespace TO %s;" % (db_user))
+ logFile("GRANT CREATE SESSION,CREATE PROCEDURE,CREATE
TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE TRIGGER,UNLIMITED Tablespace TO %s;" %
(db_user))
def writeDrymodeCmd(self, xa_db_root_user, xa_db_root_password,
db_user, db_password, db_name):
logFile("# Login to ORACLE Server from a ORACLE dba user(i.e
'sys') to execute below sql statements.")
logFile('create user %s identified by "%s";'%(db_user,
db_password))
- logFile('GRANT CREATE SESSION,CREATE PROCEDURE,CREATE
TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE PUBLIC SYNONYM,CREATE ANY
SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO %s;'%(db_user))
+ logFile('GRANT CREATE SESSION,CREATE PROCEDURE,CREATE
TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE SYNONYM,CREATE TRIGGER,UNLIMITED
Tablespace TO %s;'%(db_user))
logFile("create tablespace %s datafile '%s.dat' size 10M
autoextend on;" %(db_name, db_name))
logFile('alter user %s DEFAULT Tablespace %s;'%(db_user,
db_name))
- logFile('GRANT CREATE SESSION,CREATE PROCEDURE,CREATE
TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE PUBLIC SYNONYM,CREATE ANY
SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO %s;'%(db_user))
+ logFile('GRANT CREATE SESSION,CREATE PROCEDURE,CREATE
TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE SYNONYM,CREATE TRIGGER,UNLIMITED
Tablespace TO %s;'%(db_user))
class PostgresConf(BaseDB):
# Constructor
diff --git a/security-admin/db/oracle/xa_audit_db_oracle.sql
b/security-admin/db/oracle/xa_audit_db_oracle.sql
index 67a99be..1811149 100644
--- a/security-admin/db/oracle/xa_audit_db_oracle.sql
+++ b/security-admin/db/oracle/xa_audit_db_oracle.sql
@@ -46,6 +46,4 @@ CREATE INDEX xa_access_audit_upd_by_id ON
xa_access_audit(upd_by_id);
CREATE INDEX xa_access_audit_cr_time ON xa_access_audit(create_time);
CREATE INDEX xa_access_audit_up_time ON xa_access_audit(update_time);
CREATE INDEX xa_access_audit_event_time ON xa_access_audit(event_time);
-CREATE OR REPLACE PUBLIC SYNONYM xa_access_audit FOR xa_access_audit;
-CREATE OR REPLACE PUBLIC SYNONYM XA_ACCESS_AUDIT_SEQ FOR XA_ACCESS_AUDIT_SEQ;
commit;
diff --git a/security-admin/scripts/dba_script.py
b/security-admin/scripts/dba_script.py
index 87ef88e..e7567a3 100644
--- a/security-admin/scripts/dba_script.py
+++ b/security-admin/scripts/dba_script.py
@@ -472,11 +472,11 @@ class OracleConf(BaseDB):
log("[I] User " + db_user + "
created", "info")
log("[I] Granting permission to
" + db_user, "info")
if is_unix:
- query = get_cmd + " -c
\; -query 'GRANT CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE
VIEW,CREATE SEQUENCE,CREATE PUBLIC SYNONYM,CREATE ANY SYNONYM,CREATE
TRIGGER,UNLIMITED Tablespace TO %s;'" % (db_user)
+ query = get_cmd + " -c
\; -query 'GRANT CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE
VIEW,CREATE SEQUENCE,CREATE SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO
%s;'" % (db_user)
jisql_log(query,
db_root_password)
ret =
subprocessCallWithRetry(shlex.split(query))
elif os_name == "WINDOWS":
- query = get_cmd + "
-query \"GRANT CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE
SEQUENCE,CREATE PUBLIC SYNONYM,CREATE ANY SYNONYM,CREATE TRIGGER,UNLIMITED
Tablespace TO %s;\" -c ;" % (db_user)
+ query = get_cmd + "
-query \"GRANT CREATE SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE
SEQUENCE,CREATE SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO %s;\" -c ;" %
(db_user)
jisql_log(query,
db_root_password)
ret =
subprocessCallWithRetry(query)
if ret == 0:
@@ -624,11 +624,11 @@ class OracleConf(BaseDB):
if dryMode == False:
get_cmd = self.get_jisql_cmd(root_user
,db_root_password)
if is_unix:
- query = get_cmd + " -c \; -query 'GRANT CREATE
SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE PUBLIC
SYNONYM,CREATE ANY SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO %s;'" %
(db_user)
+ query = get_cmd + " -c \; -query 'GRANT CREATE
SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE
SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO %s;'" % (db_user)
jisql_log(query, db_root_password)
ret =
subprocessCallWithRetry(shlex.split(query))
elif os_name == "WINDOWS":
- query = get_cmd + " -query \"GRANT CREATE
SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE PUBLIC
SYNONYM,CREATE ANY SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO %s;\" -c ;" %
(db_user)
+ query = get_cmd + " -query \"GRANT CREATE
SESSION,CREATE PROCEDURE,CREATE TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE
SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO %s;\" -c ;" % (db_user)
jisql_log(query, db_root_password)
ret = subprocessCallWithRetry(query)
if ret == 0:
@@ -638,7 +638,7 @@ class OracleConf(BaseDB):
log("[E] Granting Oracle user '" + db_user + "'
failed..", "error")
sys.exit(1)
else:
- logFile("GRANT CREATE SESSION,CREATE PROCEDURE,CREATE
TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE PUBLIC SYNONYM,CREATE ANY
SYNONYM,CREATE TRIGGER,UNLIMITED Tablespace TO %s;" % (db_user))
+ logFile("GRANT CREATE SESSION,CREATE PROCEDURE,CREATE
TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE SYNONYM,CREATE TRIGGER,UNLIMITED
Tablespace TO %s;" % (db_user))
def create_auditdb_user(self, xa_db_host , audit_db_host , db_name
,audit_db_name, xa_db_root_user, audit_db_root_user, db_user, audit_db_user,
xa_db_root_password, audit_db_root_password, db_password, audit_db_password,
DBA_MODE,dryMode):
if DBA_MODE == "TRUE":
@@ -713,7 +713,7 @@ class OracleConf(BaseDB):
def writeDrymodeCmd(self, xa_db_host, audit_db_host, xa_db_root_user,
xa_db_root_password, db_user, db_password, db_name, audit_db_root_user,
audit_db_root_password, audit_db_user, audit_db_password, audit_db_name):
logFile("# Login to ORACLE Server from a ORACLE dba user(i.e
'sys') to execute below sql statements.")
logFile('create user %s identified by "%s";'%(db_user,
db_password))
- logFile('GRANT CREATE SESSION,CREATE PROCEDURE,CREATE
TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE PUBLIC SYNONYM,CREATE ANY
SYNONYM,CREATE TRIGGER,UNLIMITED TABLESPACE TO %s;'%(db_user))
+ logFile('GRANT CREATE SESSION,CREATE PROCEDURE,CREATE
TABLE,CREATE VIEW,CREATE SEQUENCE,CREATE SYNONYM,CREATE TRIGGER,UNLIMITED
TABLESPACE TO %s;'%(db_user))
logFile("create tablespace %s datafile '%s.dat' size 10M
autoextend on;" %(db_name, db_name))
logFile('alter user %s DEFAULT tablespace %s;'%(db_user,
db_name))
if not db_user == audit_db_user:
