How to check oracle database users with critical system privileges:

1.SELECT_ANY_DICTIONARY:

SELECT GRANTEE, PRIVILEGE
FROM DBA_SYS_PRIVS
WHERE PRIVILEGE=’SELECT ANY DICTIONARY’
AND GRANTEE NOT IN (‘DBA’,’DBSNMP’,’OEM_MONITOR’,
‘OLAPSYS’,’ORACLE_OCM’,’SYSMAN’,’WMSYS’);

2.SELECT ANY TABLE:

SELECT GRANTEE, PRIVILEGE
FROM DBA_SYS_PRIVS
WHERE PRIVILEGE=’SELECT ANY TABLE’
AND GRANTEE NOT IN (‘DBA’, ‘MDSYS’, ‘SYS’, ‘IMP_FULL_DATABASE’, ‘EXP_FULL_DATABASE’,
‘DATAPUMP_IMP_FULL_DATABASE’, ‘WMSYS’, ‘SYSTEM’,’OLAP_DBA’,
‘DV_REALM_OWNER’);

3.AUDIT SYSTEM:

SELECT GRANTEE, PRIVILEGE
FROM DBA_SYS_PRIVS
WHERE PRIVILEGE=’AUDIT SYSTEM’
AND GRANTEE NOT IN (‘DBA’,’DATAPUMP_IMP_FULL_DATABASE’,’IMP_FULL_DATABASE’,
‘SYS’,’AUDIT_ADMIN’);

4.EXEMPT ACCESS POLICY:

SELECT GRANTEE, PRIVILEGE
FROM DBA_SYS_PRIVS
WHERE PRIVILEGE=’EXEMPT ACCESS POLICY’;

5.BECOME USER:

SELECT GRANTEE, PRIVILEGE
FROM DBA_SYS_PRIVS
WHERE PRIVILEGE=’BECOME USER’
AND GRANTEE NOT IN (‘DBA’,’SYS’,’IMP_FULL_DATABASE’);

6.CREATE_PROCEDURE:

SELECT GRANTEE, PRIVILEGE
FROM DBA_SYS_PRIVS
WHERE PRIVILEGE=’CREATE PROCEDURE’
AND GRANTEE NOT IN ( ‘DBA’,’DBSNMP’,’MDSYS’,’OLAPSYS’,’OWB$CLIENT’,
‘OWBSYS’,’RECOVERY_CATALOG_OWNER’,’SPATIAL_CSW_ADMIN_USR’,
‘SPATIAL_WFS_ADMIN_USR’,’SYS’,’APEX_030200′,’APEX_040000′,
‘APEX_040100′,’APEX_040200′,’DVF’,’RESOURCE’,’DV_REALM_RESOURCE’,
‘APEX_GRANTS_FOR_NEW_USERS_ROLE’);

7.ALTER SYSTEM:

SELECT GRANTEE, PRIVILEGE
FROM DBA_SYS_PRIVS
WHERE PRIVILEGE=’ALTER SYSTEM’
AND GRANTEE NOT IN (‘SYS’,’SYSTEM’,’APEX_030200′,’APEX_040000′,
‘APEX_040100′,’APEX_040200′,’DBA’,’EM_EXPRESS_ALL’,’SYSBACKUP’,’GSMADMIN_ROLE’,
‘GSM_INTERNAL’,’SYSDG’,’GSMADMIN_INTERNAL’);

8.CREATE ANY LIBRARY:

SELECT GRANTEE, PRIVILEGE
FROM DBA_SYS_PRIVS
WHERE PRIVILEGE=’CREATE ANY LIBRARY’
AND GRANTEE NOT IN (‘SYS’,’SYSTEM’,’DBA’,’IMP_FULL_DATABASE’);

9.CREATE LIBRARY:

SELECT GRANTEE, PRIVILEGE
FROM DBA_SYS_PRIVS
WHERE PRIVILEGE=’CREATE LIBRARY’
AND GRANTEE NOT IN (‘SYS’,’SYSTEM’,’DBA’,’MDSYS’,’SPATIAL_WFS_ADMIN_USR’,
‘SPATIAL_CSW_ADMIN_USR’,’DVSYS’,’GSMADMIN_INTERNAL’,’XDB’);

10.GRANT ANY OBJECT PRIVILEGE:

SELECT GRANTEE, PRIVILEGE
FROM DBA_SYS_PRIVS
WHERE PRIVILEGE=’GRANT ANY OBJECT PRIVILEGE’
AND GRANTEE NOT IN (‘DBA’,’SYS’,’IMP_FULL_DATABASE’,’DATAPUMP_IMP_FULL_DATABASE’,
‘EM_EXPRESS_ALL’, ‘DV_REALM_OWNER’);

11.GRANT ANY ROLE:

SELECT GRANTEE, PRIVILEGE
FROM DBA_SYS_PRIVS
WHERE PRIVILEGE=’GRANT ANY ROLE’
AND GRANTEE NOT IN (‘DBA’,’SYS’,’DATAPUMP_IMP_FULL_DATABASE’,’IMP_FULL_DATABASE’,
‘SPATIAL_WFS_ADMIN_USR’,’SPATIAL_CSW_ADMIN_USR’,
‘GSMADMIN_INTERNAL’,’DV_REALM_OWNER’, ‘EM_EXPRESS_ALL’, ‘DV_OWNER’);

12.GRANT ANY PRIVILEGE:

SELECT GRANTEE, PRIVILEGE
FROM DBA_SYS_PRIVS
WHERE PRIVILEGE=’GRANT ANY PRIVILEGE’
AND GRANTEE NOT IN (‘DBA’,’SYS’,’IMP_FULL_DATABASE’,’DATAPUMP_IMP_FULL_DATABASE’,’DV_REALM_OWNER’, ‘EM_EXPRESS_ALL’);

Leave a Reply