FirebirdSQL logo
  • Anglaiskeyboard_arrow_down
 ROLEStatements for Revoking Privileges 

Examples of Granting the USAGE Privilege

  1. Granting the USAGE privilege on a sequence to a role:

    GRANT USAGE ON SEQUENCE GEN_AGE
  TO ROLE MANAGER;

  2. Granting the USAGE privilege on a sequence to a trigger:

    GRANT USAGE ON SEQUENCE GEN_AGE
  TO TRIGGER TR_AGE_BI;

  3. Granting the USAGE privilege on an exception to a package:

    GRANT USAGE ON EXCEPTION
  TO PACKAGE PKG_BILL;

DDL Privileges

By default, only administrators can create new metadata objects.Altering or dropping these objects is restricted to the owner of the object (its creator) and administrators.DDL privileges can be used to grant privileges for these operations to other users.

Available DDL Privileges
CREATE

Allows creation of an object of the specified type

ALTER ANY

Allows modification of any object of the specified type

DROP ANY

Allows deletion of any object of the specified type

ALL [PRIVILEGES]

Combines the CREATE, ALTER ANY and DROP ANY privileges for the specified type

Note

There are no separate DDL privileges for triggers and indexes.The necessary privileges are inherited from the table or view.Creating, altering or dropping a trigger or index requires the ALTER ANY TABLE or ALTER ANY VIEW privilege.

Examples of Granting DDL Privileges

  1. Allow user JOE to create tables

    GRANT CREATE TABLE
  TO USER Joe;

  2. Allow user JOE to alter any procedure

    GRANT ALTER ANY PROCEDURE
  TO USER Joe;

Database DDL Privileges

The syntax for granting privileges to create, alter or drop a database deviates from the normal syntax of granting DDL privileges for other object types.

Available Database DDL Privileges
CREATE

Allows creation of a database

ALTER

Allows modification of the current database

DROP

Allows deletion of the current database

ALL [PRIVILEGES]

Combines the ALTER and DROP privileges.ALL does not include the CREATE privilege.

The ALTER DATABASE and DROP DATABASE privileges apply only to the current database, whereas DDL privileges ALTER ANY and DROP ANY on other object types apply to all objects of the specified type in the current database.The privilege to alter or drop the current database can only be granted by administrators.

The CREATE DATABASE privilege is a special kind of privilege as it is saved in the security database.A list of users with the CREATE DATABASE privilege is available from the virtual table SEC$DB_CREATORS.Only administrators in the security database can grant the privilege to create a new database.

Note

SCHEMA is currently a synonym for DATABASE;this may change in a future version, so we recommend to always use DATABASE

Examples of Granting Database DDL Privileges

  1. Granting SUPERUSER the privilege to create databases:

    GRANT CREATE DATABASE
  TO USER Superuser;

  2. Granting JOE the privilege to execute ALTER DATABASE for the current database:

    GRANT ALTER DATABASE
  TO USER Joe;

  3. Granting FEDOR the privilege to drop the current database:

    GRANT DROP DATABASE
  TO USER Fedor;