Question

I want to know what are the default permissions for sql server stored procedures.
For example, I created a user in database but no role or no permissions granted except execute permission like:

GRANT EXECUTE ON SCHEMA :: [dbo] TO [newUser]

later on me (as a sa login) created a stored procedure that makes just a select from a table like:

CREATE PROCEDURE dbo.selectX AS
BEGIN
 SELECT ID, NAME FROM MyTable
END

and my user [newUser] can execute and see the result of select statement like:

EXEC dbo.selectX

up until now, I can assume that stored procedures have default permissions that my user don’t have.
I tried other dmls like UPDATE, INSERT, DELETE and user managed to execute procedures successfully.
But! when I created a proceure with ddl as create table .. such as:

CREATE PROCEDURE dbo.crtNT AS
BEGIN

    CREATE TABLE del(id int) --for test
END

and when the newUser executes this procedure error occurs like:

CREATE TABLE permission denied in database 'MyDb'

And here is my question: By default, do stored procedures have permission with DML(select, insert, update vs.) but not with DDL(create, drop table vs.)? Because I didn’t see any explanation about this situation in Books Online or anywhere else.
Any comments will be welcomed.

Answer 1

You are correct in your assumption that DDL statements are treated differently.

The procedures with DML statements work through the mechanism of Ownership Chaining however as this quote from the EXECUTE AS documentation states

Remember that ownership chaining applies only to DML statements.