DB2 UDB security, Part 4: Understand how authorities and privileges are implemented in DB2 UDB

A series of articles about IBM DB2 Universal Database for Linux, UNIX, and Windows (DB2 UDB) V8.2 security features would not be complete without a discussion of the different administrative authority levels and privileges. This article is the fourth part of a series that examines the security features available in DB2 UDB V8.2.

Part 1 looked at the user and group accounts that are required for DB2 UDB installation and operation. Part 2 discussed how to enable and write your own security plug-ins, while Part 3 looked at how security plug-ins could be customized to authenticate users. This article reviews the different administrative authority levels and privileges available in DB2 UDB and how they can be granted to and revoked from user and group accounts.

Ted J. Wasserman (tedwas.ibm@gmail.com), Database Consultant, IBM

Ted J. Wasserman's photoTed J. Wasserman is a database consultant at the IBM Silicon Valley Laboratory in San Jose, California. Ted works on the DB2 Business Partner Technical Enablement team, where he specializes in helping IBM Business Partners migrate their applications and databases to DB2. Ted has a master's degree in computer science, as well as a bachelor's degree in computer science from Queen's University in Kingston, Ontario, Canada.



20 September 2012 (First published 01 May 2006)

Also available in Chinese

Introduction

In Part 1 of this series, you learned that certain user and group accounts are needed to install and operate DB2 UDB V8.2. The important point to remember is that these accounts are defined in a security facility outside of DB2 UDB -- typically the operating system. User account management, including password policies, naming conventions, and group definitions, are all managed by this external facility.

Figure 1. Authentication versus authorization
Authentication versus authorization

DB2 UDB interacts with this external facility in order to validate a supplied user ID and password when a DB2 request is submitted. This interaction is referred to as authentication and is shown in the bottom half of Figure 1. DB2 UDB relies on this external security facility to authenticate a user and will only grant access to DB2 UDB resources if authentication is successful.

Once authentication is successful, DB2 UDB must determine whether the user has the required permissions to perform the intended operation. This process is known as authorization and is illustrated in the top half of Figure 1. DB2 UDB uses two internal mechanisms to determine whether authorization is successful -- authority levels and privileges. We cover both of these concepts in more detail in the next sections.


Authority levels

DB2 UDB defines a hierarchy of authority levels to assign a set of pre-determined administrative rights to groups of user accounts. These administrative rights include the ability to take database backups, force users off the system, view table data, and more.

There are four instance authority levels (SYSADM, SYSCTRL, SYSMAINT, SYSMON) and two database authority levels (DBAMD, LOAD). Authority levels that are defined at the instance-level apply to all databases within the instance.

Figure 2. Hierarchy of authority levels in DB2 UDB
Hierarchy of authority levels in DB2 UDB

Authority levels are arranged in the hierarchical format shown in Figure 2. At the top of the hierarchy is the SYSADM authority level, which is the highest level of authority a user can have in DB2 UDB. A user with SYSADM authority can perform all available DB2 operations. The SYSCTRL and SYSMAINT authority levels provide a subset of SYSADM rights to manage the system but do not allow access to any data in the tables. The SYSMON authority provides the ability to use the database system monitor. The DBADM authority allows a user to perform administrative tasks on a specific database in an instance and allows full access to the data and objects in that database. The LOAD authority allows a user to run the LOAD utility, DB2 UDB's high-speed bulk data loader.

Table 1 summarizes each authority level and its intended use.

Table 1. Summary of each authority level
Authority levelDescription and intended use
SYSADM
  • Highest level of administrative authority in DB2 UDB
  • Users with SYSADM authority can run utilities, issue database and database manager commands, and access the data in any table in any database within the database manager instance
  • Provides the ability to control all database objects in the instance, including databases, tables, views, indexes, packages, schemas, servers, aliases, data types, functions, procedures, triggers, table spaces, database partition groups, buffer pools, and event monitors
  • Designed for DB2 UDB administrators requiring full access to utilities and data
SYSCTRL
  • Highest level of system control authority
  • Provides the ability to perform maintenance and utility operations against the database manager instance and its databases
  • Does not allow direct access to data in the databases
  • Has the implicit privilege to connect to a database and can perform the functions of users with SYSMAINT and SYSMON authority
  • Designed for users administering a database manager instance containing sensitive data
SYSMAINT
  • Second highest level of system control authority
  • Provides the ability to perform maintenance and utility operations against the database manager instance and its databases
  • Does not allow direct access to data in the databases
  • Has the implicit privilege to connect to a database, and can perform the functions of users with SYSMON authority
  • Designed for users maintaining databases within a database manager instance that contains sensitive data
SYSMON
  • Provides the ability to take snapshots of a database manager instance or its databases
  • Designed for users maintaining databases within a database manager instance that contains sensitive data and only requires diagnostic data for problem determination
  • Does not have the ability to alter system resource usage
DBADM
  • The second highest level of administrative authority for a specific database in an instance
  • Allows the user to run certain utilities, issue database commands, and access the data in any table in the database
  • Designed for administrators that require full access to database objects and data, but not full maintenance rights
LOAD
  • Allows users to invoke the LOAD utility
  • Users also require INSERT and DELETE privileges on table being loaded, depending on the mode of the LOAD operation
  • Designed for users who only require access to bulk load a new set of data

Table 2 compares common administrative operations permitted for each authority level.

Table 2. Comparison of operations permitted for each authority level
FunctionSYSADMSYSCTRLSYSMAINTSYSMONDBADMLOAD
MIGRATE DATABASEYESNONONONONO
GRANT/REVOKE DBADMYESNONONONONO
UPDATE DBM CFGYESNONONONONO
ESTABLISH/CHANGE SYSCTRL/SYSMAINT AUTHORITYYESNONONONONO
UPDATE DB/NODE/DCS DIRECTORIESYESYESNONONONO
FORCE USERS OFF DATABASEYESYESNONONONO
CREATE/DROP DATABASEYESYESNONONONO
CREATE/DROP/ALTER TABLE SPACEYESYESNONONONO
RESTORE TO NEW DATABASEYESYESNONONONO
UPDATE DB CFGYESYESYESNONONO
BACKUP DATABASE OR TABLE SPACEYESYESYESNONONO
RESTORE TO EXISTING DATABASEYESYESYESNONONO
PERFORM ROLLFORWARD RECOVERYYESYESYESNONONO
START/STOP DATABASE INSTANCEYESYESYESNONONO
RESTORE TABLE SPACEYESYESYESNONONO
RUN TRACEYESYESYESNONONO
OBTAIN MONITOR SNAPSHOTSYESYESYESYESNONO
CREATE/ACTIVATE/DROP EVENT MONITORYESNONONOYESNO
QUERY TABLE SPACE STATEYESYESYESNOYESYES
PRUNE LOG HISTORY FILESYESYESYESNOYESNO
QUIESCE INSTANCESYESYESNONONONO
QUIESCE DATABASESYESNONONOYESNO
QUIESCE TABLE SPACEYESYESYESNOYESYES
REORG TABLEYESYESYESNOYESNO
RUN RUNSTATS UTILITYYESYESYESNOYESYES
LOAD TABLEYESNONONOYESYES
READ DATABASE TABLE DATAYESNONONOYESNO

Grant/Revoke instance-level authorities

Instance-level authorities are established by assigning user groups defined in the external security facility to the associated instance-level authority parameters (SYSADM_GROUP, SYSCTRL_GROUP, SYSMAINT_GROUP, SYSMON_GROUP). For example, if you wanted a user account called KATE to have SYSMAINT authority, you could put KATE in a group called MAINT and then update the instance parameter called SYSMAINT_GROUP to the value MAINT. Any user in the group MAINT would then have the SYSMAINT authority. To revoke the SYSMAINT authority from KATE, you could simply remove her from the MAINT group or change the value of the SYSMAINT_GROUP parameter to a new group name that she is not a member of. In the latter case, this would also revoke the SYSMAINT authority from other users in the MAINT group if they were also not a member of the new group.

Instance level authority parameters can be changed from the command line or from the Control Center. For example, to change the value of the SYSMAINT_GROUP parameter to the value MAINT using the command line, you can execute the following command:

Group names

Group names on all platforms must be 30 bytes or less in length.

update dbm cfg using SYSADM_GROUP MAINT

For the change to take effect, you must restart the DB2 UDB instance using the following two commands:

db2stop

db2start

To ensure the change has taken effect, you can view the value of the parameter by issuing the following command:

get dbm cfg

The previous series of commands and results are illustrated in Listing 1. You can also update any of the other instance-level authority parameters in a similar manner.

Listing 1. Update instance-level authority parameters using the command line
db2 => update dbm cfg using sysmaint_group maint
DB20000I  The UPDATE DATABASE MANAGER CONFIGURATION command completed
successfully.

db2 => db2stop
11/19/2005 21:19:03     0   0   SQL1064N  DB2STOP processing was successful.
SQL1064N  DB2STOP processing was successful.

db2 => db2start
11/19/2005 21:19:09     0   0   SQL1063N  DB2START processing was successful.
SQL1063N  DB2START processing was successful.

db2 => get dbm cfg

Database Manager Configuration

Node type = Enterprise Server Edition with local and remote clients

.....

 SYSADM group name                        (SYSADM_GROUP)      =
 SYSCTRL group name                       (SYSCTRL_GROUP)     =
 SYSMAINT group name                      (SYSMAINT_GROUP)    = MAINT
 SYSMON group name                        (SYSMON_GROUP)      = 

.....

To change the value of the instance-level authority parameters using the control center, open Control Center, expand the All Systems folder, expand the target system, expand the Instances folder, right-click the target instance (in this example, DB2), and select the Configure Parameters item (see Figure 3).

Figure 3. Opening the configure parameters dialog in Control Center
Configure parameters dialog in Control Center

Scroll through the list of parameters (Figure 4) and find the associated authority level parameters. Click the button beside the parameter value to change its value. In the example in Figure 4, we changed the value of the SYSMAINT_GROUP parameter to the value MAINT.

Figure 4. Changing the SYSMAINT_GROUP parameter in Control Center
DBM configuration dialog in Control Center

You must stop and restart the instance for the parameter change to take effect. From the Control Center, right-click on the target instance again, and select the Stop item. If prompted to confirm stopping the instance, click the OK button. Right-click on the target instance again, and select the Start item. You can then go back and verify that the parameter change has taken effect.

In a default DB2 UDB installation on Windows, the values of these instance-level authority parameters default to NULL. This means that any user account belonging to the local Administrators group automatically inherits these authorities. For this reason, we highly recommend explicitly changing the value of these parameters to specific group names in order prevent unintended/unauthorized access. On Linux and UNIX installations, this is not as large a concern since a NULL value defaults to the primary group of the instance owner, which by default only contains the user ID of the instance owner after an installation. However, it is still a good practice to set these parameters explicitly.

The database level authorities, such as DBADM, CONNECT, CREATETAB, and LOAD, are granted and revoked in a similar way as database privileges. They are covered in the next section.


Privileges

While instance authority levels are used as a mechanism to assign a pre-defined set of administrative rights to a group of user accounts, privileges are explicitly assigned to individual users or groups to allow them to perform specific activities on database objects (for example, to create and drop an index). Privileges strictly define the tasks that a user can perform. For example, a user may have the privilege to read a table's data but not to update that data.

Figure 5. Hierarchy of DB2 UDB authorities and privileges
Various authorities and privileges

Figure 5 shows the different levels of authorities and privileges available in DB2 UDB. This ranges from privileges on tables to privileges on schemas and stored procedures. The top of Figure 5 shows the instance authority levels that were described in the previous section. Note how the SYSADM and DBADM authorities automatically receive all the authorities and privileges below the dotted line for a particular database.

Table 3 summarizes the types of database authorities that can be granted to and revoked from users or groups of users. Only users with SYSADM or DBADM authority can grant and revoke these authorities.

Table 3. Summary of the database level authorities
Database authorities
CONNECTAllows the user to connect to the database
BINDADDAllows the user to create new packages in the database
CREATETABAllows the user to create new tables in the database
CREATE_NOT_FENCEDAllows the user to register a user-defined function (UDF) or stored procedure that is defined as NOT FENCED
IMPLICIT SCHEMAAllows the user to create objects in a schema that does not already exist (it creates the schema on-the-fly)*
QUIESCE_CONNECTAllows the user to connect to the database while it is in a quiesced state
CREATE_EXTERNAL_ROUTINEAllows the user to register an external routine (a routine written in an external language, like C and Java)

*SYSIBM becomes the owner of the implicitly created schema, and the PUBLIC group is given the privilege to create objects in this schema.

Table 4 summarizes the only available table space privilege (USE) that can be granted to and revoked from users or groups of users. The USE privilege cannot be used with SYSCATSPACE or on any system temporary table spaces.

Table 4. Summary of table space privileges
Table space privileges
USEAllows the user to create tables in the specified table space

Table 5 summarizes the different types of schema privileges that can be granted to and revoked from users or groups of users.

Table 5. Summary of schema privileges
Schema privileges
CREATEINAllows the user to create objects within the schema
ALTERINAllows the user to alter objects within the schema
DROPINAllows the user to drop objects from within the schema

Table 6 summarizes the different types of table/view privileges that can be granted to and revoked from users or groups of users.

Table 6. Summary of table and view privileges
Table/View privileges
CONTROLGives the user all privileges on the table or view, as well as the ability to grant those privileges to others (except CONTROL)
ALTERAllows the user to add columns to a table, to add or change comments on a table and its columns, to add a primary key or unique constraint, and to create or drop a table check constraint
DELETEAllows the user to delete rows from a table or view
INDEXAllows the user to create an index on a table
INSERTAllows the user to insert data into a table or view
REFERENCESAllows the user to create and drop a foreign key, specifying the table as the parent in a relationship
SELECTAllows the user to retrieve rows from a table or view, to create a view on a table, and to run the EXPORT utility
UPDATEAllows the user to change data in a table, a view, or one or more specific columns in a table or view; the user may have this privilege only on specific columns

Table 7 summarizes the only available index privilege (CONTROL) that can be granted to and revoked from users or groups of users.

Table 7. Summary of index privileges
Index privileges
CONTROLAllows the user to drop the index

Table 8 summarizes the different types of package privileges that can be granted to and revoked from users or groups of users. The section "Static and Dynamic SQL considerations" covers package concepts in more detail.

Table 8. Summary of package privileges
Package privileges
CONTROLAllows the user to rebind, drop, or execute a package as well as the ability to grant those privileges to others (except CONTROL)
BINDAllows the user to rebind an existing package
EXECUTEAllows the user to execute a package

Table 9 summarizes the only available routine privilege (EXECUTE) that can be granted to and revoked from users or groups of users.

Table 9. Summary of routine privileges
Routine privileges
EXECUTEAllows the user to invoke a routine, create a function that is sourced from that routine (applies to functions only), and to reference the routine in any DDL statement, such as CREATE VIEW, CREATE TRIGGER, or when defining a constraint

Table 10 summarizes the different types of sequence privileges that can be granted to and revoked from users or groups of users.

Table 10. Summary of sequence privileges
Sequence privileges
USAGEAllows the user to use NEXTVAL and PREVVAL expressions for the sequence
ALTERAllows the user to alter sequence properties using the ALTER SEQUENCE statement

Granting privileges

Like the instance-level authorities, privileges can be granted and revoked using command syntax or the Control Center. In order to grant or revoke privileges, you must have a database connection. Figure 6 shows the syntax diagram for the GRANT statement for table and view privileges. The GRANT statement syntax for other database objects is similar and is available in the DB2 UDB documentation.

Figure 6. GRANT statement syntax diagram for tables and views
GRANT statement syntax diagram for tables and views

For example, to grant the INSERT privilege on the ACCOUNT table to user JEFF using the GRANT statement, you would issue the following statement:

GRANT INSERT ON TABLE account TO USER jeff

To grant the SELECT privilege on the CUSTOMER table to the group SALESREPS, you would issue the following statement:

GRANT SELECT ON TABLE customer TO GROUP salesreps

Care must be taken when granting authorities and privileges to a user or group, as DB2 UDB will let you grant those privileges to a non-existent account. At some later time, an account might be created with the same name and automatically receive all of the previously granted authorities and privileges.

You can also grant privileges using the Control Center by expanding the All Databases folder, expanding the target database, expanding the folder containing the database object of interest, right-clicking on that object, and choosing the Privileges item. In Figure 7, we expanded the Tables folder in the SAMPLE database, right-clicked on the EMPLOYEE table, and chose the Privileges item.

Figure 7. Table privileges dialog in Control Center
Table Privileges dialog in Control Center

In the table privileges dialog window, you can select either the User or Group tab, depending on whether you want to grant privileges to a user or group. If the user/group is not already in the list, click the Add User or Add Group button to add a user or group. You can specify which privileges should be granted to the user or group by clicking on the drop-down box for each privilege and selecting either Yes, No, or Grant. Selecting Yes means the privilege should be granted, selecting No means the privilege should not be granted, and selecting Grant means the privilege should be granted as well as the privilege to grant other users/groups the privilege. Clicking the Grant All button grants all the available privileges to the designated user or group. Clicking the Revoke All button revokes all the available privileges from the designated user or group.

From Figure 7, you can see that a user called MARK has only been granted the INSERT privilege on the EMPLOYEE table, meaning that MARK can only INSERT data into it, not read or update it. This of course assumes that MARK is not a member of a group that has these privileges or has SYSADM/DBADM authority.

Granting privileges to users versus groups

You may have noticed from the examples above or the GRANT statement syntax diagram that you have the ability to specify whether you want to grant a privilege to a user or group, by using the TO USER or TO GROUP clauses respectively. If neither of these clauses is specified but the specified name is defined in the operating system only as a group, then GROUP is assumed. If the specified name is defined in the operating system only as user or if it is undefined, USER is assumed. If the specified name is defined in the operating system as both, an error is returned. As a best practice, we always recommend including either the TO USER or the TO GROUP clause in GRANT statements to avoid any ambiguity.

PUBLIC group

DB2 UDB internally uses a pseudo-group called PUBLIC, which privileges can be granted to and revoked from. PUBLIC is not actually a group defined in the external security facility, but is rather a way to assign privileges to any user who successfully authenticates. You can grant privileges to and revoke them from the PUBLIC group like any other group. For example, to revoke the IMPLICIT_SCHEMA authority from the PUBLIC group, you could issue the following statement:

REVOKE IMPLICIT_SCHEMA ON DATABASE FROM PUBLIC

It is important to understand the security implications of granting privileges to the PUBLIC group. Any user that supplies a valid user ID and password has the ability to perform any operation the PUBLIC group has been granted.

WITH GRANT OPTION

Many of the database object privileges also allow you to include the WITH GRANT OPTION clause in the GRANT statement. This enables you to grant a privilege to a user/group while giving the user or members of the group the right to grant the same privilege to other users/groups. For example, the following statement grants the ALTERIN, CREATEIN, and DROPIN privileges on the schema called ACCT to the group G1 as well as the ability for members of the group G1 to grant those same privileges to other users or groups:

GRANT ALTERIN, CREATEIN, DROPIN ON SCHEMA ACCT TO GROUP G1 WITH GRANT OPTION

CONTROL privilege

The CONTROL privilege for an object cannot be granted to other users or groups using the WITH GRANT OPTION clause. It must be specifically granted to a user or group and can only be done by someone with SYSADM or DBADM authority.

The WITH GRANT OPTION is only available for the GRANT statements of packages, routines, schemas, tables, views, and table spaces.

Revoking privileges

The REVOKE statement is used to revoke privileges that were previously granted. Figure 8 shows the syntax diagram of the REVOKE statement for tables and views. Again, the REVOKE syntax for other database objects is similar and is available in the DB2 UDB documentation.

Figure 8. REVOKE statement syntax diagram for tables and views
REVOKE statement syntax diagram for tables and views

For example, to revoke the ALTER privilege on the STAFF table from user JEN, you could issue the following statement:

REVOKE ALTER ON TABLE staff FROM USER jen

To revoke all privileges on the STAFF table from JEN, you could issue the following statement:

REVOKE ALL PRIVILEGES ON TABLE staff FROM USER jen

Privileges can also be revoked using the Control Center in the same way they were granted. Simply re-open the object privileges dialog window, as was previously shown in Figure 7. To revoke a privilege, change the drop-down list for that privilege to NO, or click the Revoke All button to revoke all the privileges associated with that object.

To revoke privileges on database objects, you must have DBADM authority, SYSADM authority, or CONTROL privilege on that object. Note that holding a privilege WITH GRANT OPTION is not sufficient to revoke that privilege. To revoke the CONTROL privilege from another user, you must have SYSADM or DBADM authority.

Revoking a privilege from a user or group revokes that privilege granted by any other account. However, revoking a privilege from a user or group does not revoke that same privilege from other accounts that were granted the privilege by that same user/group. For example, assume that user BEN grants SELECT WITH GRANT OPTION to user RICK, then RICK grants SELECT to users RAVI and CHRIS. If BEN later revokes the SELECT privilege from RICK, RAVI and CHRIS still retain the SELECT privilege.

Revoking specific privileges from a member of a group

You may have a situation where you want to grant a privilege to a group and then revoke the privilege from just one member of the group. However, you cannot revoke an explicit privilege that was never explicitly granted in the first place. You have two options in this case:

  • You can remove the member from the group; or, create a new group with fewer members and grant the privilege to the new group
  • You can revoke the privilege from the group and then grant it to individual members of the group

Granting and revoking database authorities

The database level authorities, such as DBADM, LOAD, and CREATETAB are also granted to a user or a group using the GRANT statement. For example, the following statement grants the DBADM authority to the user SALLY:

GRANT DBADM ON DATABASE TO USER sally

The following statement grants the LOAD authority to the group MAINT:

GRANT LOAD ON DATABASE TO GROUP maint

Recall that users with the LOAD authority also require the INSERT privilege to load data into a table and the DELETE privilege if the LOAD operation is defined as REPLACE.

Revoking DBADM authority

To revoke DBADM authority, you must have SYSADM authority.

To revoke database level authorities, use the REVOKE statement. For example, to revoke the LOAD authority from the group MAINT, you would issue the following statement:

REVOKE LOAD ON DATABASE FROM GROUP maint


Implicit privileges

In some circumstances, the database manager implicitly grants certain privileges to a user when a user creates a database object, such as a table or a package, or when the DBADM authority level is granted. It is important to understand which implicit privileges are granted and the security implications of these implicit privileges. Table 11 summarizes the cases where implicit privileges are granted.

Table 11. Summary of the implicit privileges granted for different actions
ActionImplicit privileges granted to the user performing the action
Create a new database
  • GRANT of DBADM authority with BINDADD, CONNECT, CREATETAB, CREATE_EXTERNAL_ROUTINE, CREATE_NOT_FENCED_ROUTINE, IMPLICIT_SCHEMA, LOAD, and QUIESCE_CONNECT authorities to creator (SYSADM or SYSCTRL)
  • GRANT of BINDADD, CREATETAB, CONNECT and IMPLICIT_SCHEMA to PUBLIC
  • BIND and EXECUTE privilege on each successfully bound utility to PUBLIC
  • SELECT on system catalog tables and views to PUBLIC
  • USE privilege on USERSPACE1 table space to PUBLIC
  • EXECUTE WITH GRANT privilege to PUBLIC on all functions in SYSFUN schema
  • EXECUTE privilege to PUBLIC on all procedures in SYSIBM schema
Grant DBADM authority
  • GRANT of BINDADD, CONNECT, CREATETAB, CREATE_EXTERNAL_ROUTINE, CREATE_NOT_FENCED_ROUTINE, IMPLICIT_SCHEMA, LOAD and QUIESCE_CONNECT
Schema
  • When explicitly created, CREATEIN, ALTERIN, DROPIN is granted to the user that created the schema
  • When implicitly created, CREATEIN is additionally given to PUBLIC
Create object (table, index, package)
  • GRANT of CONTROL to object creator
Create a view
  • GRANT of the CONTROL privilege only if the user has CONTROL privilege for all tables, views, and nicknames referenced in the view definition

For example, suppose you initially granted the DBADM authority to the user PAUL and at a later time you decided to revoke that authority. To revoke the DBADM authority from PAUL, you could use the following statement:

REVOKE DBADM ON DATABASE FROM USER paul

After executing this command, PAUL would no longer have DBADM authority; however, he would still have the GRANT, BINDADD, CONNECT, CREATETAB, CREATE_EXTERNAL_ROUTINE, CREATE_NOT_FENCED_ROUTINE, IMPLICIT_SCHEMA, LOAD and QUIESCE_CONNECT authorities on the database that were implicitly granted when PAUL was originally granted the DBADM authority. These would need to be explicitly revoked from PAUL.

It is considered a good security practice to explicitly revoke many of the privileges that are implicitly granted to PUBLIC after a new database is created. This helps lock down your system and ensures only users who are supposed to access the database actually do.


Static and dynamic SQL considerations

When the syntax of an SQL statement is fully known at compile time, the statement is referred to as static SQL. This is in contrast to a dynamic SQL statement, whose syntax is not known until run-time.

There are some differences in the way privileges are handled between static and dynamic SQL. One such difference is how group membership is handled. In general, group membership is only considered for dynamic SQL and non-database object authorizations (such as instance-level commands and utilities). The one exception to this general case occurs when privileges are granted to PUBLIC; these are considered when static SQL is processed.

Another difference is when authorization actually takes place. If a program is coded with static SQL statements, packages (database objects that contain the optimized and executable form of SQL statements) must be created in the database before the associated program can execute the SQL statements contained in the package. Authorization for static SQL takes place at compile or bind time. At run-time, a user only needs to have EXECUTE privileges on the package in order to execute the statements in it. This does not imply that the user has direct access to the underlying database objects. The only access to the underlying database objects is through the specific statements in the package. For dynamic SQL statements, authorization takes place on a per statement basis. The user executing the statement must have the appropriate privileges to execute that statement at run-time, either because they were explicitly granted them or possess them through group membership.

For example, suppose the following static SQL statement is found in an embedded-SQL application:

EXEC SQL SELECT col INTO :hostvar FROM table123;

Suppose the application file containing this statement was pre-compiled, producing a bind file called sampleapp.bnd. If the developer BARBARA wanted to bind this file to the database (thus creating a package), she would explicitly need to have the SELECT privilege on TABLE123 in order for the BIND command to succeed. The one exception to this rule would be if the PUBLIC group had been granted this privilege. BARBARA would also need the BINDADD authority, if this was a new package, or only the BIND privilege, if this was an existing package that she wanted to re-bind to the database (for example, because the database statistics were recently updated).

Packages may also include dynamic SQL, in which case the required privileges depend on the value that is specified for the DYNAMICRULES clause of the PRECOMPILE/BIND command when the package is precompiled or bound to the database. To use dynamic SQL in a package bound with DYNAMICRULES RUN (the default), the user who runs a dynamic SQL application must have the privileges necessary to issue each SQL request, as well as the EXECUTE privilege on the package. The privileges may be granted to the user's ID, to any group of which the user is a member, or to PUBLIC.

If the application is bound with the DYNAMICRULES BIND option, DB2 UDB associates the package owner's user ID with the application packages. This allows any user who runs the application to inherit the privileges associated with the package owner's user ID.

For example, suppose the application file in the example above also contained dynamic SQL, as shown in Listing 2:

Listing 2. Dynamic SQL in an embedded SQL application
EXEC SQL BEGIN DECLARE SECTION;
  char hostVarStmt[50];
  short hostVarDeptnum;
EXEC SQL END DECLARE SECTION;

strcpy(hostVarStmt, "DELETE FROM org WHERE deptnum = ?"); 

EXEC SQL PREPARE Stmt1 FROM :hostVarStmt; 

hostVarDeptnum = 15;
EXEC SQL EXECUTE Stmt1 USING :hostVarDeptnum;

If BARBARA wanted to bind the same bind file to the database, she would need the BINDADD authority if this was a new package or just the BIND privilege if the package already existed. Further, suppose BARBARA used the following BIND command to bind the file:

BIND sampleapp.bnd QUALIFIER u1 OWNER u2 DYNAMIC RULES RUN

In this case, all unqualified SQL statements (statements that did not qualify database objects with a schema) would use the schema U1. The user U2 would own the package because of the use of the OWNER clause. Since BARBARA specified the DYNAMIC RULES RUN clause, the privileges of the user running the application (executing the package) are checked for dynamic SQL.

However, if BARBARA used the following BIND command to bind the file, the privileges of the package owner would be checked for dynamic SQL:

BIND sampleapp.bnd QUALIFIER u1 OWNER u2 DYNAMIC RULES BIND

In this case, the owner of the package is specified as U2. Thus at run-time, the privileges of the user U2 are checked, rather than the user running the application.

Routine privileges

The EXECUTE privilege applies to all types of routines, including functions, procedures, and methods within the database. Once a user is granted the EXECUTE privilege for a routine, the user can then invoke that routine, create a function that is sourced from that routine (applies to functions only), and reference the routine in any DDL statement, such as CREATE VIEW or CREATE TRIGGER. Individual privileges for objects accessed inside the routine are not required.


How privileges/authorities are maintained in DB2 UDB

Instance level authorities

Instance level authority levels (SYSADM, SYSCTRL, SYSMAINT, and SYSMON) and group membership are defined outside of DB2 UDB, and are therefore not reflected in system catalog tables.

DB2 UDB stores information about privileges in seven system catalog views:

  • SYSCAT.DBAUTH - database privileges
  • SYSCAT.COLAUTH - table and view column privileges
  • SYSCAT.INDEXAUTH - index privileges
  • SYSCAT.PACKAGEAUTH - package privileges
  • SYSCAT.SCHEMAAUTH - schema privileges
  • SYSCAT.TABAUTH - table and view privileges
  • SYSCAT.TBSPACEAUTH - table space privileges

These views can be queried just like any other ones. For example, to find out what table privileges a user EMMA has, you could issue the statement shown in Listing 3:

Listing 3. Querying the SYSCAT.TABAUTH view to find privilege information
SELECT substr(grantor,1,8) AS grantor,
       SUBSTR(grantee,1,8) AS grantee,
       granteetype AS gtype,
       SUBSTR (tabschema,1,8) AS schema,
       SUBSTR (tabname,1,8) AS tabname,
       controlauth AS ctl,
       alterauth AS alt,
       deleteauth AS del,
       indexauth AS idx,
       insertauth AS ins,
       selectauth AS sel,
       refauth AS ref,
       updateauth AS upd
  FROM syscat.tabauth 
  WHERE grantee = 'EMMA'

GRANTOR GRANTEE  GTYPE SCHEMA   TABNAME  CTL ALT DEL IDX INS SEL REF UPD
------- -------- ----- -------- -------- --- --- --- --- --- --- --- ---
INST1   EMMA     U     INST1    TABLE1   Y   G   G   G   G   G   G   G

A grantee type (GTYPE) of 'U' means that the grantee (the account that holds the privilege) is a user account. A GTYPE value of 'G' means that the grantee is a group account. In the other columns, a value of 'Y' means the privilege is held, a value of 'N' means the privilege is not held, and a value of 'G' means the privilege is held and grantable to others. In Listing 3, you see that the user EMMA has CONTROL privilege on the table TABLE1 as well as all the other available table privileges, including the ability to grant those privileges to other users.

Implicitly granted privileges

Privileges granted to users by the system will have SYSIBM as the grantor.

To find out all accounts with privileges, you can query each of the system catalog views and combine the results together using the UNION operator, as shown in Listing 4:

Listing 4. Determine all authorization names with privileges
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'DATABASE' FROM SYSCAT.DBAUTH
   UNION
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'TABLE   ' FROM SYSCAT.TABAUTH
   UNION
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'PACKAGE ' FROM SYSCAT.PACKAGEAUTH
   UNION
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'INDEX   ' FROM SYSCAT.INDEXAUTH
   UNION
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'COLUMN  ' FROM SYSCAT.COLAUTH
   UNION
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'SCHEMA  ' FROM SYSCAT.SCHEMAAUTH
   UNION
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'SERVER  ' FROM SYSCAT.PASSTHRUAUTH
   ORDER BY GRANTEE, GRANTEETYPE, 3

You can also find out all the privileges a user or group has using the Control Center. To do this, open Control Center, expand the All Databases folder, expand the target database, expand the Users and Group Objects folder, expand either the DB Users or DB Groups folder, and double-click the row for the user or group of interest. In Figure 9, the privileges dialog for the user MARK in the SAMPLE database is opened. By selecting the Database tab, you can see that the user MARK has the CONNECT and LOAD authorities. To revoke these authorities, you could uncheck the box beside each authority.

Figure 9. Opening the change user (privileges) dialog in Control Center
Change user dialog in Control Center

GET AUTHORIZATIONS command

DB2 UDB has a command called GET AUTHORIZATIONS that is a useful shortcut for reporting the authorities of the current user. This command uses the values found in the database manager configuration file and the authorization system catalog view (SYSCAT.DBAUTH). Listing 5 shows the results of issuing the command:

Listing 5. GET AUTHORIZATIONS command
 db2 => get authorizations

 Administrative Authorizations for Current User

 Direct SYSADM authority                    = NO
 Direct SYSCTRL authority                   = NO
 Direct SYSMAINT authority                  = NO
 Direct DBADM authority                     = NO
 Direct CREATETAB authority                 = NO
 Direct BINDADD authority                   = NO
 Direct CONNECT authority                   = NO
 Direct CREATE_NOT_FENC authority           = NO
 Direct IMPLICIT_SCHEMA authority           = NO
 Direct LOAD authority                      = NO
 Direct QUIESCE_CONNECT authority           = NO
 Direct CREATE_EXTERNAL_ROUTINE authority   = NO
 Direct SYSMON authority                    = NO

 Indirect SYSADM authority                  = YES
 Indirect SYSCTRL authority                 = NO
 Indirect SYSMAINT authority                = NO
 Indirect DBADM authority                   = NO
 Indirect CREATETAB authority               = YES
 Indirect BINDADD authority                 = YES
 Indirect CONNECT authority                 = YES
 Indirect CREATE_NOT_FENC authority         = NO
 Indirect IMPLICIT_SCHEMA authority         = YES
 Indirect LOAD authority                    = NO
 Indirect QUIESCE_CONNECT authority         = NO
 Indirect CREATE_EXTERNAL_ROUTINE authority = NO
 Indirect SYSMON authority                  = NO

Having a Direct authority means the authority was explicitly granted to the user. Having an Indirect authority means the user belongs to a group that was granted that authority. A user might have both a direct and indirect authority if the user was explicitly granted that authority and belonged to a group that was granted that authority.


Deciding which privileges/authority levels are necessary

Usually, different users in your organization require different levels of database access. For example, a customer service representative would need a much more restrictive access level than a database administrator. This section presents a few scenarios and discusses the authorities and privileges that are needed in each case.

Scenario 1

Tony, an analyst in the finance department, runs queries every morning to find out the profitability of the company's stores.

In this case, Tony can be granted CONNECT privilege on the databases of interest, as well as the SELECT privilege on all the tables he requires access to.

Scenario 2

Janet, a database administrator, looks after all database maintenance activities for all databases in the company. Her responsibilities include taking backups, restoring the database when required, storage management, and running traces. She should not be able to access any of the data in the database.

In this case, Janet could be granted the SYSMAINT authority. SYSCTRL authority might also be considered if SYSMAINT is too restrictive.

Scenario 3

Jim, an application programmer, develops and tests the database manager application programs. He may also create tables of test data.

In this case, Jim requires BINDADD, BIND, CONNECT, and CREATETAB on one or more databases, some specific schema privileges, and a list of privileges on some tables. CREATE_EXTERNAL_ROUTINE may also be required if he is developing routines in an external programming language, like C or Java.

Scenario 4

Susan, a planner in the marketing department, needs to load the PRODUCT_SALES table with new data she receives from the department stores every night in order to determine new buying trends.

In this case, Susan requires the CONNECT privilege on the database, the LOAD authority, as well as the INSERT and SELECT privileges on the PRODUCT_SALES table.


Controlling access to database objects using schemas

A common question frequently asked by new DB2 UDB database administrators is how they can provide an environment for their users to create and drop their own database objects while limiting the access of these objects from other users. While giving each user his or her own physical database would solve the problem, it may not be the optimal solution. A better solution might be to control database object access through the use of schemas.

Schemas are database objects used to logically group related database objects together. They are also often used as a way to indicate object ownership. Schemas have privileges associated with them, allowing the schema owner to control which users have the privilege to create, alter, and drop objects in the schema. A schema owner is initially given all of these privileges on the schema, with the ability to grant them to others. A user with SYSADM or DBADM authority can change the privileges held by users on any schema.

By default, when a database is created, all users have the IMPLICIT_SCHEMA authority. This allows any user to create objects in any schema not already in existence. An implicitly created schema allows any user to create other objects in the same schema. If the IMPLICIT_SCHEMA authority is revoked from PUBLIC, schemas can be explicitly created using the CREATE SCHEMA statement or implicitly created by users (such as those with DBADM authority) who have been implicitly granted the IMPLICIT_SCHEMA authority.

To give each user control of their own database objects, a database administrator could explicitly create a schema for each user. The administrator would then grant all the required privileges on the schema only to each individual user. Other users would then be prevented from tampering with any objects created in the schema. To further lock down the system, the IMPLICIT_SCHEMA authority could also be revoked from PUBLIC so that the only way a user could create a database object would be through a designated schema which they had the appropriate privileges for. This approach allows users to create whatever database objects they need and prevents them from tampering or getting their database objects mixed up with those created by other users.


Summary

In this article, we have reviewed the different authority levels and privileges defined in DB2 UDB and how they can be assigned to users using command line syntax and the Control Center. We also discussed some of the finer details of privileges, including implicit privileges, the differences in authorization between static and dynamic SQL, and how privilege information is stored in the system catalog tables. Finally, we covered how schemas can be used as an effective mechanism for controlling access to database objects in multi-user environments. With this knowledge, you should be able to define a privilege/authority strategy that minimizes the threat of accidental or intentional system misuse.

Resources

Learn

Get products and technologies

Discuss

Comments

developerWorks: Sign in

Required fields are indicated with an asterisk (*).


Need an IBM ID?
Forgot your IBM ID?


Forgot your password?
Change your password

By clicking Submit, you agree to the developerWorks terms of use.

 


The first time you sign into developerWorks, a profile is created for you. Information in your profile (your name, country/region, and company name) is displayed to the public and will accompany any content you post, unless you opt to hide your company name. You may update your IBM account at any time.

All information submitted is secure.

Choose your display name



The first time you sign in to developerWorks, a profile is created for you, so you need to choose a display name. Your display name accompanies the content you post on developerWorks.

Please choose a display name between 3-31 characters. Your display name must be unique in the developerWorks community and should not be your email address for privacy reasons.

Required fields are indicated with an asterisk (*).

(Must be between 3 – 31 characters.)

By clicking Submit, you agree to the developerWorks terms of use.

 


All information submitted is secure.

Dig deeper into Information management on developerWorks


static.content.url=http://www.ibm.com/developerworks/js/artrating/
SITE_ID=1
Zone=Information Management
ArticleID=101435
ArticleTitle=DB2 UDB security, Part 4: Understand how authorities and privileges are implemented in DB2 UDB
publish-date=09202012