grant and revoke

Hell0 All, IDS 11.50.FC6 on HP-ux 11.23 $dbschema -d mydb -p vikash grant resource to "vikash"; # original permission resource >grant dba to vikash;Permission granted. $dbschema -d mydb -p vikash grant dba to "vikash"; # new permission dba >revoke dba from vikash;Permission revoked. # dba revoked $dbschema -d mydb -p vikash grant connect to "vikash"; # new permission connect and not resource Just wondering if this is expected behaviour, if yes then like to learn the reason? Regards, Vikas

On Sun, Sep 16, 2012 at 11:51 PM, VIKAS HIVARKAR <vikas.hivarkar@gmail.com>wrote: > IDS 11.50.FC6 on HP-ux 11.23 > > $dbschema -d mydb -p vikash > grant resource to "vikash"; # original permission resource> > >grant dba to vikash;> Permission granted. > > $dbschema -d mydb -p vikash > grant dba to "vikash"; # new permission dba> > >revoke dba from vikash;> Permission revoked. # dba revoked > > $dbschema -d mydb -p vikash > grant connect to "vikash"; # new permission connect and not resource> > Just wondering if this is expected behaviour, if yes then like to learn the > reason? > When you REVOKE either DBA or RESOURCE privilege from a user, they are left with CONNECT privilege. You have to REVOKE CONNECT from the user as well, in a separate operation, if they are to be prevented from connecting altogether— and ensure that PUBLIC does not have connect (or higher) privileges. The reason is that the elevated privileges are 'connect + resource' and removing the resource privilege should leave the connect privileges in place. Similarly for 'connect + dba'; removing the dba privilege should leave the connect in place. It's not the only possible design; it is, however, the design that has been in Informix since circa 1985, so it is unlikely to change now. -- Jonathan Leffler <jonathan.leffler@gmail.com> #include <disclaimer.h> Guardian of DBD::Informix - v2011.0612 - http://dbi.perl.org "Blessed are we who can laugh at ourselves, for we shall never cease to be amused." --f46d0435c1d23e0e4104c9e664a1