Oninit
Talk to an expert →

Informix Error -379

-379 Cannot revoke privilege on columns.

In the GRANT statement, you can grant UPDATE or SELECT privilege on specific columns. However, the REVOKE statement accepts only the keywords for the type of privilege; you cannot revoke access to specific columns. If you want to change the columns allowed to a certain user, you must first REVOKE the privilege in full, then GRANT it on the new list of columns.

Oninit® Troubleshooting Guidance

Reasons / Common Causes

-379 is an asymmetry between GRANT and REVOKE: GRANT supports column-level UPDATE/ SELECT privileges (e.g. GRANT UPDATE (status) ON orders TO app_user), but REVOKE doesn't accept a column list at all — it only works at the whole-privilege level.

  1. A REVOKE statement attempting to name specific columns, mirroring the syntax used to originally grant a column-level privilege — the direct, only cause.
  2. Assuming REVOKE syntax mirrors GRANT syntax symmetrically, when in this specific case it doesn't.
  3. Wanting to narrow an existing column-level privilege (e.g. revoke access to one column while keeping it for others) without realizing there's no direct REVOKE-with-columns path for that.
Solutions / Resolution
  1. Fully revoke the privilege first, then grant it again with the desired new column list, per the official guidance — this is the only supported way to change which columns a column-level privilege covers.
  2. Don't attempt to name columns in a REVOKE statement — only the privilege type keyword is accepted there.
Examples
Narrowing a column-level privilege
-- Originally granted:
GRANT UPDATE (status, priority) ON orders TO app_user;

-- To narrow this down to just "status", REVOKE fully first:
REVOKE UPDATE ON orders FROM app_user;
-- then re-grant with the new column list:
GRANT UPDATE (status) ON orders TO app_user;
The disallowed direct attempt
REVOKE UPDATE (priority) ON orders FROM app_user;
-- -379: REVOKE doesn't accept a column list
Diagnostic Checks
  1. Check whether the REVOKE statement includes a column list — this is never valid, regardless of whether the original GRANT was column-scoped.
  2. Confirm the intended new column list before re-granting, since the full privilege is removed as an intermediate step.
Related Errors / Related Topics
  • -353 — "No table or view specified when granting/revoking privileges." Another GRANT/REVOKE-clause structural restriction in the same privilege-management family.

REVOKE never accepts a column list, even for a privilege that was originally granted at the column level — revoke fully, then re-grant with the adjusted column list.