DBA privileges with objects and nested UDRs
Objects created in the course of running a DBA routine
are owned by the user who executes the routine unless a statement
in the routine explicitly names someone else as the owner. For example,
suppose that user tony registers the promo() routine
shown in Privileges on objects associated with a UDR, but includes
the DBA keyword:
CREATE DBA PROCEDURE promo()
...
END PROCEDURE;
Although user tony owns the routine, if user marty runs it, user marty owns table hotcatalog. User libby owns libby.maillist because her name qualifies the table name, making her the table owner.
A called routine does not inherit the DBA privilege. If a DBA routine executes a routine that was created without the DBA keyword, the DBA privileges do not affect the called routine.
If a routine that is registered without the DBA keyword calls a DBA routine, the caller must have Execute privileges on the called DBA routine. Statements within the DBA routine execute as they would within any DBA routine.
The following
example demonstrates what occurs when a DBA and non-DBA routine interact.
Procedure dbspace_cleanup() executes procedure cluster_catalog().
Procedure cluster_catalog() creates an index. The
C-language source for cluster_catalog() includes
the following statements:
strcopy(statement, "CREATE INDEX stmt");
ret = mi_exec(conn,
"create cluster index c_clust_ix on catalog(catalog_num)",
MI_QUERY_NORMAL);
DBA procedure dbspace_cleanup() invokes
the other routine with the following statement:
EXECUTE PROCEDURE cluster_catalog(hotcatalog)
Assume tony registered dbspace_cleanup() as
a DBA procedure, and cluster_catalog() is registered
without the DBA keyword, as follows:
CREATE DBA PROCEDURE dbspace_cleanup(loc CHAR)
EXTERNAL NAME ...
LANGUAGE C
END PROCEDURE
CREATE PROCEDURE cluster_catalog(catalog CHAR)
EXTERNAL NAME ...
LANGUAGE C
END PROCEDURE
GRANT EXECUTE ON PROCEDURE dbspace_cleanup(CHAR) to marty;
User marty runs dbpace_cleanup().
Index c_clust_ix is created by a non-DBA routine. Therefore tony,
who owns both routines, also owns c_clust_ix. By contrast, marty owns
index c_clust_ix if cluster_catalog() is
a DBA procedure, as in the following registering and grant statements:
CREATE PROCEDURE dbspace_cleanup(loc CHAR)
EXTERNAL NAME ...
LANGUAGE C
END PROCEDURE
CREATE DBA PROCEDURE cluster_catalog(catalog CHAR)
EXTERNAL NAME ...
LANGUAGE C
END PROCEDURE
GRANT EXECUTE ON PROCEDURE cluster_catalog(CHAR) to marty;
The dbspace_cleanup() procedure need not be a DBA procedure to call a DBA procedure.