从Oracle存储过程运行系统命令

Question

I am trying to run the following command:

    select os_command.exec('/bin/mkdir /home/smucha/testdir_ora3') from dual;
/

This works fine when I am logged in as SYS .

When I try to run is as a user SEBA I get the following error:

ORA-29532: java.security.AccessControlException: the Permission (java.io.FilePermission /bin/mkdir execute) has not been granted to SEBA. The PL/SQL to grant this is dbms_java.grant_permission( 'SEBA', 'SYS:java.io.FilePermission', '/bin/mkdir', 'execute' )
ORA-06512: at "SEBA.OS_COMMAND", line 68
29532. 00000 -  "Java call terminated by uncaught Java exception: %s"
*Cause:    A Java exception or error was signaled and could not be
           resolved by the Java code.
*Action:   Modify Java code, if this behavior is not intended.

I have tried to grant the required permission using SYS account.

After executing the following code:

call dbms_java.grant_permission( 'SEBA', 
                     'SYS:java.io.FilePermission', '/bin/mkdir', 'execute' );

I get:

dbms_java.grant_permission 'SEBA', succeeded.

However, when I try to execute the command:

select os_command.exec('/bin/mkdir /home/smucha/testdir_ora3') from dual;
/

I get the same error as before.

Can you please advise what do I need to do to run os commands?

Everything works when I am connected as SYS , so it looks like user SEBA has some permission problems.

I just do not know which permissions to grant?

Answer 1

I just want to share my experience , stored procedures won't accept the ddl privileges provided via the role.So the privilege which you are trying to give to user seba is via role then it is not valid.Example if you are having role which having privilege create table and if you assign this role to seba,seba can't create the table via stored procedure.So we have to give grant create any table to seba directly or you have to use authid current user while creating stored procedure.So please check whether you are giving direct privilege to seba or via role in this case.

check seba is having create any directory privilege if not then provide grant create any directory to seba and ensure seba got privilge from select * from dba_directories;