Re: EXEC in stored procedure

From: Kalen Delaney (replies_at_public_newsgroups.com)
Date: 10/26/04


Date: Tue, 26 Oct 2004 10:18:00 -0700

Hi Magnus

The dynamic select doesn't obey the same ownership chaining rules as
statements outside the EXEC. Users running the stored procedure must have
explicit permissions on the objects in the dynamic SQL.

A SELECT outside of the EXEC obey ownerships chaining rules, and any user
who has execute permission on procedure can run the statements in the
procedure, as long as the procedure and the table have the same owner.

Why do you need the EXEC? It serves no purpose here.

-- 
HTH
----------------
Kalen Delaney
SQL Server MVP
www.SolidQualityLearning.com
"Magnus Blomberg" <magnus.blomberg@skanska.se> wrote in message 
news:utP4%2373uEHA.4084@TK2MSFTNGP10.phx.gbl...
> Hello!
>
> I'm trying to use
>   EXEC ('SELECT * FROM Categories')
> into a Stored Procedure, but the users get permission denied on object
> 'Categories'
> If I'm using
>   SELECT * FROM Categories
> everything works.
> The user haven't any permission of Categories, but the SP should have it.
>
> Is the EXEC command inside the SP run as the user? Why?
>
> Regards Magnus
>
> 


Relevant Pages

  • Re: Granting EXEC to all my user sprocs in one hit
    ... this assigns the passed user id exec ... Grant the EXEC permission using SEMgr across all my user-sprocs at ... >> I'm detaching the live copy and copying the files across to dev machine, ... >> over 200 sprocs. ...
    (microsoft.public.sqlserver.security)
  • Re: EXEC in stored procedure
    ... The dynamic select doesn't obey the same ownership chaining rules as ... A SELECT outside of the EXEC obey ownerships chaining rules, ... > into a Stored Procedure, but the users get permission denied on object ...
    (microsoft.public.sqlserver.security)
  • Re: Remote Agents
    ... security, you have to be very carefull with who has permission to exec. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: How to setup permissions of a Stored Procedure that execute other Stored Procedure
    ... >I have a stored procedure like the following: ... >What am I missing? ... As far as I can see the user has permission to execute ... Exec USER_Y.sp_InnerStored ...
    (microsoft.public.sqlserver.programming)
  • Re: noise words, @@ERROR, and stop and resume indexing
    ... EXEC sp_fulltext_catalog 'adsfull', 'stop' ... > 1) check noise words inside stored procedure ... > can be solved by changing the language specific file with noise words ... ...
    (microsoft.public.sqlserver.fulltext)