OPTION indicates that the grantee can grant this access right to other users, with or
without the grant option.
As a simple example, consider the following statement.
GRANT SELECT ON ANY TABLE TO ricflair
This statement enables user ricflair to query any table in the database.
Different implementations of SQL provide different ranges of access rights.
The following is a typical list:
• Select: Grantee may read entire database; individual tables; or specific
columns in a table.
• Insert: Grantee may insert rows in a table; or insert rows with values for specific
columns in a table.
• Update: Semantics is similar to INSERT.
• Delete: Grantee may delete rows from a table.
• References: Grantee is allowed to define foreign keys in another table that
refer to the specified columns.
The REVOKE command has the following syntax:
REVOKE { privileges | role }
[ON table]
FROM { user | role | PUBLIC }
Thus, the following statement revokes the access rights of the preceding example:
REVOKE SELECT ON ANY TABLE FROM ricflair
Cascading Authorizations
The grant option enables an access right to cascade through a number of users.We
consider a specific access right and illustrate the cascade phenomenonin Figure 5.4 .
The figure indicates that Ann grants the access right to Bob at time t 10 and to
Chris at time t 20. Assume that the grant option is always used. Thus, Bob is able
to grant the access right to David at t 30. Chris redundantly grants the access right
to David at t 50. Meanwhile, David grants the right to Ellen, who in turn grants it
to Jim; and subsequently David grants the right to Frank.
Just as the granting of privileges cascades from one user to another using
the grant option, the revocation of privileges also cascaded. Thus, if Ann
revokes the access right to Bob and Chris, then the access right is also revoked
to David, Ellen, Jim, and Frank. A complication arises when a user receives the
same access right multiple times, as happens in the case of David. Suppose that
Bob revokes the privilege from David. David still has the access right because
it was granted by Chris at t 50. However, David granted the access right to
Ellen after receiving the right, with grant option, from Bob but prior to receiving
it from Chris.Most implementations dictate that in this circumstance, the access
Sedang diterjemahkan, harap tunggu..
