Re: Does revoke all from public actually work?

belakimem@aol.com wrote: > > Online Version 5.07.UC1 > > I create a table and revoked all on the table from Public. I also granted > select on the table to public. Yet any user can update the table. > > Does anybody know why ? > > Potential responders, please reply to my email address as well as the > List. Thank You. This only seems to work correctly if YOU own the table. A DBA can create tables (and other db objects) "owned" by other users. Under this scenario, any revoke may appear to work but is a NO-OP. As a default, under non-ANSI mode databases, new tables default to PUBLIC permissions for INSERT, UPDATE, DELETE, etc. with a GRANTOR of <table owner>. If the DBA (non-owner) issues a REVOKE, Informix only revokes permissions granted by the current user (none). Since the REVOKE statement completed, dbaccess will report "Permission Revoked". We frequently run DBA scripts as user "informix", but want tables and triggers owned by "root". The way we have gotten around this problem is to issue a "DELETE FROM systabauth WHERE tabid = (SELECT tabid FROM systables where tabname = 'whatever');" after the revoke statement. If you are not changing table ownership, then I don't know what the problem is. Paul.