20.07.2013 Views

Beginning SQL

Beginning SQL

Beginning SQL

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Chapter 12<br />

The situation gets a little sticky, though, when Sue has received GRANT OPTION on a table from two different<br />

sources and has issued a GRANT to Frank.<br />

Jim issues a GRANT to Sue WITH GRANT OPTION:<br />

GRANT SELECT<br />

ON tblPersonnel<br />

TO usrSue<br />

WITH GRANT OPTION<br />

Sue now issues a GRANT to Frank:<br />

GRANT SELECT<br />

ON tblPersonnel<br />

TO usrFrank<br />

Mary comes along and issues GRANT OPTION to Sue as well:<br />

GRANT SELECT<br />

ON tblPersonnel<br />

TO usrSue<br />

WITH GRANT OPTION<br />

Jim now revokes the GRANT from Sue:<br />

REVOKE SELECT<br />

ON tblPersonnel<br />

FROM usrSue<br />

What happens to the privileges that Sue granted to Frank? In this case, some DBMSs would revoke<br />

Frank’s privileges because it can be demonstrated that he was granted privileges derived from Jim<br />

because Mary had not yet granted GRANT OPTION privileges to Sue at the time Sue issued the GRANT<br />

privilege to Frank. On the other hand, Sue still has the right to issue privileges from the GRANT OPTION<br />

given her by Mary, so it is not a cut-and-dry case that Frank’s privileges should be revoked, and some<br />

DBMSs leave Frank with his privileges.<br />

As you can see, it is not always a simple case of who issued the WITH GRANT OPTION but may also be a<br />

matter of timing, and how this scenario is handled may vary from DBMS to DBMS.<br />

In the <strong>SQL</strong>1 standard, the REVOKE statement is missing from the syntax. Access to tables and views is<br />

determined by GRANT statements at the time the database is set up, and there is no mechanism for<br />

changing the privileges once the database structure is defined. In spite of this, almost all commercial<br />

DBMSs provided the REVOKE statement. The next section covers a couple of syntax extensions that provide<br />

you more flexibility when using the REVOKE statement.<br />

The CASCADE and RESTRICT Options<br />

346<br />

The <strong>SQL</strong>2 standard added the REVOKE statement and in fact added some extensions to give the REVOKE<br />

statement more flexibility. The CASCADE extensions gave the user the ability to determine how privileges<br />

are revoked when the privileges have been further granted down to other users. The other extension,<br />

RESTRICT, allows revoking the GRANT OPTION without revoking the privileges themselves.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!