Setup: I have two trees of scripts that run on Oracle 11g – one set ensures the correct instance configuration and that all of the DBA proxy accounts are there to connect to the dbadmin account, and the other set builds and modify our database environments.
Problem: Proxied in to the DBADMIN account, the second set of scripts runs just fine, except for one piece: the data pre-population. The procedures that allow loading of the data create under the appropriate schema just fine, and the script that loads the data runs just fine if ran as SYS AS SYSDBA, but when I try to run it as DBADMIN immediately after creating the procedure it calls I get PLS-00904: insufficient privilege to access object schema.package for every call. I can’t even have the script GRANT EXECUTE ON schema.package TO DBADMIN because that (of course) generates the expected ORA-01749: you may not GRANT/REVOKE privileges to/from yourself error.
To put it more simply:
(as DBADMIN:)
...
CREATE OR REPLACE PACKAGE BODY other_schema.package_name IS
...
PROCEDURE add_data(...)
...
(succeeds, and is testably working)
(later, in another script called by the same parent script, still as DBADMIN:)
BEGIN
other_schema.package_name.add_data(...);
...
(raises the PLS-00904 given above – Insufficient privilege)
Any ideas on how I can give the DBADMIN account EXECUTE access to a package that it hasn’t created yet, or how DBADMIN can get access itself without stopping the whole script stream, log out and back in as SYS AS SYSDBA to GRANT it? (The whole point here is to have ZERO manual steps beyond the initial “run this script tree”, and to only have one time ever up front when the SYS AS SYSDBA is ever used.)
You could grant DBADMIN the EXECUTE ANY PROCEDURE privilege. This will allow it to, er, execute any procedure that is to run programs owned by any other user.
Like the other ANY procedures it is extremely powerful and should not be granted lightly. (In fact it is one of the most powerful ANY privileges there is).