For example, A4 may receive a certain UPDATE R privilege from both A2 and A3. It is possible for a user to receive a certain On R to a third account C, also with the GRANT OPTION. Suppose that B is given the GRANT OPTION by A If the GRANT OPTION is given, this means that B can also grant that privilege on R to other accounts. Whenever the owner A of a relation R grantsĪ privilege on R to another account B, the privilege can be given to B with or without the GRANT OPTION. Will see how the REVOKE command is used in the example in Section REVOKE command is included for the purpose of canceling privileges. Hence, a mechanism for revoking privileges is needed. To grant the SELECT privilege to a user for a specific task and then revoke that For example, the owner of a relation may want We will illustrate this discussion with the example The same applies to limiting B to retrieving only certain tuples of R a view V can be created by defining the view by means of a query thatĪ wants to allow B to access. That includes only those attributes and then grant SELECT on V to B. To be able to retrieve only some fields of R, For example, if the owner A of a relation R wants another account B The mechanism of views is an important discretionaryĪuthorization mechanism in its own right. In the view definition in order to specify the query that corresponds to the view.Ģ. Have the SELECT privilege on all relations involved Notice that to create a view, the account must Gives the account the capability to reference (or refer to) a relation R Level, the DBA can control the privilege to access each individual relation or view in the database. Independently of the relations in the database. At this level, the DBA specifies the particular Informally, there are two levels for assigning privileges to use the Necessarily entitle the account holder to all the functionality provided by Operations may also be controlled thus, having an account does not The DBMS must provide selective access to each relationĪccounts.
Refer, roughly speaking, to a user account (or group of user accounts). In SQL2 and later versions, the concept of an authorization identifier is used to The main idea is to include statements in the query language that allow the DBAĪnd selected users to grant and revoke privileges.
Many current relational DBMSs use some variation of this tech-nique. Similar to the one originally developed for the SQL language (see Chapters 4Īnd 5). In particular, we will discuss a system of privileges somewhat Let us consider privileges in the context of a The typical method of enforcing discretionary access control in aĭatabase system is based on the granting and revoking of privileges. Based on Granting and Revoking Privileges
0 kommentar(er)
