Question

I have 3 users in my oracle Database

user_admin
user
user_query

• The user_admin have dba rol.
• user have connect and resource rol
• and user_query the same as user.

I want to configure the last one to deny him of all kind of insert,update,delete but form the full tablespace not from a table, view or procedure…

The point is to have a secure-only-querying data user.

But i can’t do it for a tablespace, at least as far i know.

Any idea?

Answer 1

You can loop through all table that use the tablespace in question and grant select. I would try to stay away from powerful privs like “SELECT ANY TABLE”, as that would apply to the entire database.

For example, if your tablespace is named XXX then:

BEGIN
  FOR tbl IN (SELECT owner, table_name
                FROM dba_tables dt
               WHERE dt.tablespace_name = 'XXX') LOOP
  EXECUTE IMMEDIATE 'GRANT SELECT ON ' || tbl.owner || '.' || tbl.table_name || ' TO USER_QUERY';
  END LOOP;
END;