Summary of System Privileges
This section contains a brief summary of all of Oracle’s system privileges, listed in alphabetical order. Some system privileges are new in Oracle8; this is noted in the list. A complete list of new Oracle8 system privileges can also be found later in this chapter.
- ALTER ANY CLUSTER
Allows you to execute the ALTER CLUSTER command for all clusters in the database.
- ALTER ANY INDEX
Allows you to execute the ALTER INDEX command for all indexes in the database.
- ALTER ANY LIBRARY (Oracle8)
Allows you to execute the CREATE OR REPLACE LIBRARY command to alter an existing external library in another schema.
- ALTER ANY PROCEDURE
Allows you to execute the ALTER FUNCTION, ALTER PACKAGE, and ALTER PROCEDURE commands to recompile any function, package, or procedure in the database. Also allows you to execute the CREATE OR REPLACE FUNCTION, CREATE OR REPLACE PACKAGE, and CREATE OR REPLACE PROCEDURE commands on any existing function, package, or procedure in the database.
- ALTER ANY ROLE
Allows you to execute the ALTER ROLE command to add, change, or remove a password on the role.
- ALTER ANY SEQUENCE
Allows you to execute the ALTER SEQUENCE command on any sequence in the database.
- ALTER ANY SNAPSHOT
Allows you to execute the ALTER SNAPSHOT command on any snapshot in the database.
- ALTER ANY TABLE
Allows you to execute the ALTER TABLE command on any table in the database. You must have the ALTER ANY TRIGGER privilege to execute the ALTER TABLE ... ENABLE/DISABLE ALL TRIGGERS command on tables outside your schema.
- ALTER ANY TRIGGER
Allows you to execute the ALTER TRIGGER command for all triggers in the database. With the ALTER ANY TRIGGER privilege, you can execute an ALTER TRIGGER ... ENABLE/DISABLE command, but you must also have the ALTER ANY TABLE privilege to execute the ALTER TABLE ... ENABLE/DISABLE ALL TRIGGERS command on tables outside your schema.
- ALTER ANY TYPE (Oracle8)
Allows you to execute the ALTER TYPE command on any user-defined type in any schema.
- ALTER DATABASE
Allows you to execute the ALTER DATABASE command.
- ALTER PROFILE
Allows you to execute the ALTER PROFILE command.
- ALTER RESOURCE COST
Allows you to execute the ALTER RESOURCE COST command.
- ALTER ROLLBACK SEGMENT
Allows you to execute the ALTER ROLLBACK SEGMENT command.
- ALTER SESSION
Allows you to execute the ALTER SESSION SET SQL_TRACE command.
- ALTER SYSTEM
Allows you to execute the ALTER SYSTEM command.
- ALTER TABLESPACE
Allows you to execute the ALTER TABLESPACE command.
- ALTER USER
Allows you to execute the ALTER USER command. You do not need the ALTER USER privilege to execute the ALTER USER userid IDENTIFIED BY password command to change your own password.
- ANALYZE ANY
Allows you to execute the ANALYZE command on all tables, clusters, and indexes in the database.
- AUDIT ANY
Allows you to execute the AUDIT command on any database object in any schema.
- AUDIT SYSTEM
Allows you to execute the AUDIT command to audit SQL statements.
- BACKUP ANY TABLE
Necessary to perform a full export.
- BECOME USER
Necessary to import from a full export. There is no SQL statement that directly uses this privilege. However, there is an internal API (Application Programming Interface) that is used by the Import utility and checks for this privilege.
- COMMENT ANY TABLE
Allows you to execute the COMMENT statement for all tables in the database.
- CREATE ANY CLUSTER
Allows you to execute the CREATE CLUSTER statement and specify any schema as owner.
- CREATE ANY DIRECTORY (Oracle8)
Allows you to execute the CREATE DIRECTORY statement. Since all BFILE directories are owned by SYS, there is no CREATE DIRECTORY privilege.
- CREATE ANY INDEX
Allows you to execute the CREATE INDEX statement and specify any schema as owner.
- CREATE ANY LIBRARY (Oracle8)
Allows you to define a library for external functions in any schema.
- CREATE ANY PROCEDURE
Allows you to execute the CREATE FUNCTION, CREATE PROCEDURE, and CREATE PACKAGE statements and specify any schema as owner.
- CREATE ANY SEQUENCE
Allows you to execute the CREATE SEQUENCE statement and specify any schema as owner.
- CREATE ANY SNAPSHOT
Allows you to execute the CREATE SNAPSHOT statement and specify any schema as owner.
- CREATE ANY SYNONYM
Allows you to execute the CREATE SYNONYM statement and specify any schema as owner.
- CREATE ANY TABLE
Allows you to execute the CREATE TABLE statement and specify any schema as owner. You still must have a quota specified in the TABLESPACE clause.
- CREATE ANY TRIGGER
Allows you to execute the CREATE TRIGGER statement on any table in the database.
- CREATE ANY TYPE (Oracle8)
Allows you to create a user-defined type in any schema.
- CREATE ANY VIEW
Allows you to execute the CREATE VIEW statement and specify any schema as owner.
- CREATE CLUSTER
Allows you to create a cluster in your own schema.
- CREATE DATABASE LINK
Allows you to create a private database link.
- CREATE LIBRARY (Oracle8)
Allows you to execute the CREATE LIBRARY command to define a library in your schema for external procedures.
- CREATE PROCEDURE
Allows you to create a function, package, or procedure in your own schema.
- CREATE PROFILE
Allows you to execute the CREATE PROFILE command.
- CREATE PUBLIC DATABASE LINK
Allows you to execute the CREATE PUBLIC DATABASE LINK command. This is the one case in which there isn’t a corresponding CREATE ANY version of the privilege. There is no CREATE ANY DATABASE LINK.
- CREATE PUBLIC SYNONYM
Allows you to execute the CREATE PUBLIC DATABASE LINK command.
- CREATE ROLE
Allows you to execute the CREATE ROLE command.
- CREATE ROLLBACK SEGMENT
Allows you to execute the CREATE ROLLBACK command.
- CREATE SEQUENCE
Allows you to create a sequence in your own schema.
- CREATE SESSION
Allows you to connect to the database.
- CREATE SNAPSHOT
Allows you to create a snapshot in your own schema.
- CREATE SYNONYM
Allows you to create a private synonym.
- CREATE TABLE
Allows you to create a table in your own schema. You still must have a quota specified for the tablespace listed in the TABLESPACE clause.
- CREATE TABLESPACE
Allows you to execute the CREATE TABLESPACE command.
- CREATE TRIGGER
Allows you to create a trigger on a table in your schema.
- CREATE TYPE (Oracle8)
Allows you to create a user-defined type in your schema.
- CREATE USER
Allows you to execute the CREATE USER command.
- CREATE VIEW
Allows you to execute the CREATE VIEW command within your schema.
- DELETE ANY TABLE
Allows you to execute the DELETE statement against any table in the database.
- DROP ANY CLUSTER
Allows you to execute the DROP CLUSTER command for all clusters in the database.
- DROP ANY DIRECTORY (Oracle8)
Allows you to execute the DROP DIRECTORY command. Since all BFILE directories are owned by SYS, there is no DROP DIRECTORY privilege.
- DROP ANY INDEX
Allows you to execute the DROP INDEX command for all indexes in the database.
- DROP ANY LIBRARY (Oracle8)
Allows you to execute the DROP LIBRARY command for any library in the database.
- DROP ANY PROCEDURE
Allows you to execute the DROP FUNCTION, DROP PACKAGE, and DROP PROCEDURE commands for all functions, packages, and procedures in the database.
- DROP ANY ROLE
Allows you to execute the DROP ROLE command.
- DROP ANY SEQUENCE
Allows you to execute the DROP SEQUENCE command for any sequence in any schema.
- DROP ANY SNAPSHOT
Allows you to execute the DROP SNAPSHOT command for any snapshot in the database.
- DROP ANY SYNONYM
Allows you to execute the DROP SYNONYM command for any synonym in the database.
- DROP ANY TABLE
Allows you to execute the DROP TABLE command for any table in the database. You need the DROP ANY TABLE privilege to truncate a table that is not in your schema.
- DROP ANY TRIGGER
Allows you to execute the DROP TRIGGER command for all triggers in the database.
- DROP ANY TYPE (Oracle8)
Allows you to drop any user-defined type in any schema.
- DROP ANY VIEW
Allows you to execute the DROP VIEW command for all views in the database.
- DROP PROFILE
Allows you to execute the DROP PROFILE command.
- DROP PUBLIC DATABASE LINK
Allows you to execute the DROP PUBLIC DATABASE LINK command. As with the CREATE PUBLIC DATABASE LINK system privilege, there is no corresponding DROP ANY DATABASE LINK system privilege.
- DROP PUBLIC SYNONYM
Allows you to execute the DROP PUBLIC SYNONYM command.
- DROP ROLLBACK SEGMENT
Allows you to execute the DROP ROLLBACK SEGMENT command for any tablespace in the database.
- DROP TABLESPACE
Allows you to execute the DROP TABLESPACE command for any tablespace in the database.
- DROP USER
Allows you to execute the DROP USER command for any user in the database.
- EXECUTE ANY LIBRARY (Oracle8)
Allows you to execute an external function defined in any library in any schema.
- EXECUTE ANY PROCEDURE
Allows you to execute any function, procedure, or package in the database.
- EXECUTE ANY TYPE (Oracle8)
Allows you to reference and execute any type or method in any schema.
- FORCE ANY TRANSACTION
Allows you to execute the COMMIT FORCE command for any in-doubt transaction in the database.
- FORCE TRANSACTION
Allows you to execute the COMMIT FORCE command for any in-doubt transaction you have created.
- GRANT ANY PRIVILEGE
Allows you to execute the GRANT system privilege command for any role that has not been granted to you WITH ADMIN OPTION.
- GRANT ANY ROLE
Allows you to execute the GRANT role command for any role that has not been granted to you WITH ADMIN OPTION. Also allows you to execute the REVOKE role command for any role that has not been granted to you WITH ADMIN OPTION. You may need to have the ALTER USER privilege to specify whether or not the role is a default role.
- INSERT ANY TABLE
Allows you to execute the INSERT statement for any table in the database. In order to insert directly into data dictionary tables, you must have the INSERT_CATALOG_ROLE role.
- LOCK ANY TABLE
Allows you to execute the LOCK TABLE command for all tables in the database.
- MANAGE TABLESPACE
Allows you to execute the ALTER TABLESPACE command to take tablespaces offline, to take tablespaces online, or to begin or end backups.
- SELECT ANY SEQUENCE
Allows you to execute the SELECT statement to retrieve the next sequence value for any sequence in the database, except those owned by SYS.
- SELECT ANY TABLE
Allows you to execute the SELECT statement to query any table in the database. In order to select directly from tables in the data dictionary, you must have the SELECT_CATALOG_ROLE role.
- UNLIMITED TABLESPACE
Allows you to have unlimited quotas in every tablespace in the database. This system privilege is automatically granted when the RESOURCE role is granted.The UNLIMITED TABLESPACE system privilege is the only system privilege that cannot be granted to a role.
- UPDATE ANY TABLE
Allows you to execute the UPDATE statement for all tables and views in the database. In order to update tables in the data dictionary directly, you must have the UPDATE_CATALOG_ROLE role.