{"id":40309,"date":"2026-03-16T15:18:48","date_gmt":"2026-03-16T14:18:48","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/?p=40309"},"modified":"2026-03-23T14:31:31","modified_gmt":"2026-03-23T13:31:31","slug":"remove-grant-to-public-in-oracle-databases","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/","title":{"rendered":"Remove grant to public in Oracle databases"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"h-cis-recommendations\">CIS recommendations<\/h2>\n\n\n\n<p>The <a href=\"https:\/\/en.wikipedia.org\/wiki\/Center_for_Internet_Security\">Center for Internet Security<\/a> publishes the &#8220;CIS Oracle database 19c Benchmark&#8221; with recommendations to enhance the security of Oracle databases.<\/p>\n\n\n\n<p>One type of recommendations is to remove grant execute to public (chapter 5.1.1.1-5.1.1.7 Public Privileges). There is a list of powerful SYS packages. And for security reasons, only users that really need this functionality should have access to it. But per default, it is granted to public and all users can use it.<\/p>\n\n\n\n<p>In theory, to fix that is easy, e.g.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>REVOKE EXECUTE ON DBMS_LDAP FROM PUBLIC;<\/code><\/pre>\n\n\n\n<p>But is that really a good idea?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-who-is-using-an-object-from-another-schema\">Who is using an object from another schema?<\/h2>\n\n\n\n<p>If the object is used in a program unit, a named PL\/SQL block (package, function, procedure, trigger), you can see the dependency in the view dba_dependencies.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nselect distinct owner from dba_dependencies \nwhere referenced_name=&#039;DBMS_LDAP&#039; and owner&lt;&gt;&#039;SYS&#039;\norder by 2,1;\n<\/pre><\/div>\n\n\n<p>And for these objects, the users already have a direct grant for it. So, remove of the public grant does not affect these user-objects.<br>But wait! Rarely used, but there are named blocks with invokers right&#8217;s (<code>create procedure procname AUTHID CURRENT_USER is<\/code>&#8230;) . See <a href=\"https:\/\/docs.oracle.com\/cd\/E29597_01\/network.1111\/e16543\/authorization.htm\" id=\"https:\/\/docs.oracle.com\/cd\/E29597_01\/network.1111\/e16543\/authorization.htm\">How Roles Work in PL\/SQL Blocks<\/a><\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nselect owner, object_name from dba_procedures where authid=&#039;CURRENT_USER&#039;;\n<\/pre><\/div>\n\n\n<p>In this case the user can also access objects used in program units he has granted via a role. You have to check which users have access to these program units. These users are potentially affected by the change!<\/p>\n\n\n\n<p>For objects used outside of above program units: If a user has a direct grant, or an indirect grant via a role to the object, removing the grant to public does not affect the work of this user with these objects.<\/p>\n\n\n\n<p>So, what about the other users without direct\/indirect grants to the object (except &#8220;public&#8221;)? How can we see if above mentioned objects are used (e.g. from external code in a Perl script or an application server connecting to the database)?<\/p>\n\n\n\n<p>To see the usage of an object, we can use unified auditing and create an audit policy for the object.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\ncreate audit policy CIS_CHECK_USAGE\nactions\nexecute on sys.dbms_ldap\nwhen &#039;SYS_CONTEXT(&#039;&#039;USERENV&#039;&#039;, &#039;&#039;CURRENT_USER&#039;&#039;) != &#039;&#039;SYS&#039;&#039;&#039; EVALUATE PER STATEMENT;\n\naudit policy CIS_CHECK_USAGE;\nalter audit policy cis_check_usage add actions EXECUTE on SYS.DBMS_LOB;\nalter audit policy cis_check_usage add actions ...\n<\/pre><\/div>\n\n\n<p>Hint: Unified auditing can also be used if the Oracle binary is not relinked for unified audit (the relink only deactivates traditional auditing, unified auditing is always active)<\/p>\n\n\n\n<p>To automate above steps, you can do it dynamically with the Perl script below (run it with $ORACLE_HOME\/perl\/bin\/perl, so the required Oracle modules are present):<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: perl; title: ; notranslate\" title=\"\">\n  use DBI;\n  my $dbh = DBI-&gt;connect(&#039;dbi:Oracle:&#039;, &#039;&#039;, &#039;&#039;,{ PrintError =&gt; 1, ora_session_mode=&gt;2 });\n  my @pdblist;\n  my $sth=$dbh-&gt;prepare(q{select PDB_NAME from cdb_pdbs where pdb_name&lt;&gt;&#039;PDB$SEED&#039; union select &#039;CDB$ROOT&#039; from dual});\n  $sth-&gt;execute();\n  while (my @row = $sth-&gt;fetchrow_array) {\n    push(@pdblist, $row&#x5B;0]);\n  }\n\n  foreach my $pdb (@pdblist){\n    # switch PDB\n    print &quot;PDB=$pdb\\n&quot;;\n    $dbh-&gt;do(&quot;alter session set container=$pdb&quot;);\n\n    # create cis_check_usage\n    print q{ create audit policy cis_check_usage actions all on sys.AUD$ when &#039;SYS_CONTEXT(&#039;&#039;USERENV&#039;&#039;, &#039;&#039;CURRENT_USER&#039;&#039;) != &#039;&#039;SYS&#039;&#039;&#039; EVALUATE PER STATEMENT}.&quot;\\n&quot;;\n    $dbh-&gt;do(q{ create audit policy cis_check_usage actions all on sys.AUD$ when &#039;SYS_CONTEXT(&#039;&#039;USERENV&#039;&#039;, &#039;&#039;CURRENT_USER&#039;&#039;) != &#039;&#039;SYS&#039;&#039;&#039; EVALUATE PER STATEMENT});\n    $dbh-&gt;do(q{ audit policy cis_check_usage});\n\n    # add execute to public\n    my $sql=q{\n     SELECT  PRIVILEGE||&#039; on &#039;||owner||&#039;.&#039;||table_name FROM DBA_TAB_PRIVS WHERE GRANTEE=&#039;PUBLIC&#039; AND PRIVILEGE=&#039;EXECUTE&#039; AND TABLE_NAME IN (\n     &#039;DBMS_LDAP&#039;,&#039;UTL_INADDR&#039;,&#039;UTL_TCP&#039;,&#039;UTL_MAIL&#039;,&#039;UTL_SMTP&#039;,&#039;UTL_DBWS&#039;,&#039;UTL_ORAMTS&#039;,&#039;UTL_HTTP&#039;,&#039;HTTPURITYPE&#039;,\n     &#039;DBMS_ADVISOR&#039;,&#039;DBMS_LOB&#039;,&#039;UTL_FILE&#039;,\n     &#039;DBMS_CRYPTO&#039;,&#039;DBMS_OBFUSCATION_TOOLKIT&#039;, &#039;DBMS_RANDOM&#039;,\n     &#039;DBMS_JAVA&#039;,&#039;DBMS_JAVA_TEST&#039;,\n     &#039;DBMS_SCHEDULER&#039;,&#039;DBMS_JOB&#039;,\n     &#039;DBMS_SQL&#039;, &#039;DBMS_XMLGEN&#039;, &#039;DBMS_XMLQUERY&#039;,&#039;DBMS_XMLSTORE&#039;,&#039;DBMS_XMLSAVE&#039;,&#039;DBMS_AW&#039;,&#039;OWA_UTIL&#039;,&#039;DBMS_REDACT&#039;,\n     &#039;DBMS_CREDENTIAL&#039;\n      )};\n    $sth=$dbh-&gt;prepare(&quot;$sql&quot;);\n    $sth-&gt;execute();\n    while (my @result = $sth-&gt;fetchrow_array) {\n      print  &quot;alter audit policy cis_check_usage add actions $result&#x5B;0]\\n&quot;;\n      $dbh-&gt;do(&quot;alter audit policy cis_check_usage add actions $result&#x5B;0]&quot;);\n    }\n  }\n\n<\/pre><\/div>\n\n\n<h2 class=\"wp-block-heading\" id=\"h-revoke-the-grants\">Revoke the grants<\/h2>\n\n\n\n<p>After some days\/weeks, you can evaluate the usage of dbms_ldap or other objects audited by the cis_check_usage policy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nselect dbusername, current_user, object_schema||&#039;.&#039;||object_name as object, \n      sql_text, system_privilege_used,\n       system_privilege, unified_audit_policies, con_id , event_timestamp \nfrom cdb_unified_audit_trail \nwhere unified_audit_policies like &#039;%CIS_CHECK_USAGE%&#039;;\n<\/pre><\/div>\n\n\n<p>With this query, we see the usage of the objects we audited with the CIS_CHECK_USAGE policy. If there are no rows, check if you really enabled the policy (<code>select * from audit_unified_enabled_policies where policy_name='CIS_CHECK_USAGE';<\/code>)<\/p>\n\n\n\n<p>With the next query, we exclude the objects per user that can be accessed by a direct grant or a grant via a role, so, a revoke from public will not affect this user.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nselect distinct current_user, action_name, object_schema, object_name, con_id \nfrom cdb_unified_audit_trail a\nwhere unified_audit_policies like &#039;%CIS_CHECK_USAGE%&#039;\nand current_user not in ( \n  select grantee from cdb_tab_privs -- direct grant\n  where owner=a.object_schema and table_name=a.object_name and con_id=a.con_id\nunion all\n  select r.grantee from cdb_role_privs r, cdb_tab_privs t -- grant via role\n  where r.granted_role=t.grantee and r.con_id=t.con_id \n  and r.grantee=a.current_user   and t.owner=a.object_schema \n  and t.table_name=a.object_name and r.con_id=a.con_id\n);\n<\/pre><\/div>\n\n\n<p>And what is left, needs attention.<\/p>\n\n\n\n<p>Sometimes the objects are used by a background process, e.g. if you see the object_name DBMS_SQL, but  in sql_text it is not used, then the user probably does not need it. But if it is present in sql_text, then the user definitely needs a grant. I recommend to grant the object via a role, so it behaves as before, the user can use it directly, but not in procedures\/functions\/packages.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\ncreate  role cis_dbms_sql ;\ngrant execute on sys.dbms_sql to cis_dbms_sql;\ngrant cis_dbms_sql to user1;\n<\/pre><\/div>\n\n\n<p>Then pragmatically, remove the execute rights from public on a test system and check if the application still works as expected. Generate the revoke commands dynamically, and do not forget to also dynamically generate an undo script in case of problems:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nSELECT  &#039;revoke &#039;||PRIVILEGE||&#039; on &#039;||owner||&#039;.&#039;||table_name||&#039; from PUBLIC;&#039; \nFROM DBA_TAB_PRIVS \nWHERE GRANTEE=&#039;PUBLIC&#039; AND PRIVILEGE=&#039;EXECUTE&#039; AND TABLE_NAME IN (\n   &#039;DBMS_LDAP&#039;,&#039; UTL_INADDR&#039; ,&#039;UTL_TCP&#039;, &#039;UTL_MAIL&#039;, &#039;UTL_SMTP&#039;, &#039;UTL_DBWS&#039;,\n &#039;UTL_ORAMTS&#039;,&#039;UTL_HTTP&#039;,&#039;HTTPURITYPE&#039;,\n&#039;DBMS_ADVISOR&#039;,&#039;DBMS_LOB&#039;,&#039;UTL_FILE&#039;,\n&#039;DBMS_CRYPTO&#039;,&#039;DBMS_OBFUSCATION_TOOLKIT&#039;, &#039;DBMS_RANDOM&#039;,\n&#039;DBMS_JAVA&#039;,&#039;DBMS_JAVA_TEST&#039;,\n&#039;DBMS_SCHEDULER&#039;,&#039;DBMS_JOB&#039;,\n&#039;DBMS_SQL&#039;, &#039;DBMS_XMLGEN&#039;, &#039;DBMS_XMLQUERY&#039;,&#039;DBMS_XMLSTORE&#039;,&#039;DBMS_XMLSAVE&#039;,&#039;DBMS_AW&#039;,&#039;OWA_UTIL&#039;,&#039;DBMS_REDACT&#039;,\n&#039;DBMS_CREDENTIAL&#039;\n);\n\nSELECT  &#039;grant &#039;||PRIVILEGE||&#039; on &#039;||owner||&#039;.&#039;||table_name||&#039; to PUBLIC;&#039;\nFROM DBA_TAB_PRIVS \nWHERE GRANTEE=&#039;PUBLIC&#039; AND PRIVILEGE=&#039;EXECUTE&#039; AND TABLE_NAME IN (\n   &#039;DBMS_LDAP&#039;,&#039; UTL_INADDR&#039; ,&#039;UTL_TCP&#039;, &#039;UTL_MAIL&#039;, &#039;UTL_SMTP&#039;, &#039;UTL_DBWS&#039;,\n &#039;UTL_ORAMTS&#039;,&#039;UTL_HTTP&#039;,&#039;HTTPURITYPE&#039;,\n&#039;DBMS_ADVISOR&#039;,&#039;DBMS_LOB&#039;,&#039;UTL_FILE&#039;,\n&#039;DBMS_CRYPTO&#039;,&#039;DBMS_OBFUSCATION_TOOLKIT&#039;, &#039;DBMS_RANDOM&#039;,\n&#039;DBMS_JAVA&#039;,&#039;DBMS_JAVA_TEST&#039;,\n&#039;DBMS_SCHEDULER&#039;,&#039;DBMS_JOB&#039;,\n&#039;DBMS_SQL&#039;, &#039;DBMS_XMLGEN&#039;, &#039;DBMS_XMLQUERY&#039;,&#039;DBMS_XMLSTORE&#039;,&#039;DBMS_XMLSAVE&#039;,&#039;DBMS_AW&#039;,&#039;OWA_UTIL&#039;,&#039;DBMS_REDACT&#039;,\n&#039;DBMS_CREDENTIAL&#039;\n);\n<\/pre><\/div>\n\n\n<p>It has to be run in each PDB and CDB$ROOT.<\/p>\n\n\n\n<p>If all works as expected, then it is fine.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-installation-of-patches-and-new-components\">Installation of patches and new components<\/h2>\n\n\n\n<p>But keep that in mind if you want to install something later. It may fail. For example, install an rman catalog:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: sql; title: ; notranslate\" title=\"\">\nRMAN&gt; create catalog;\ncreate catalog;\nerror creating dbms_rcvcat package body\nRMAN-00571: ===========================================================\nRMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============\nRMAN-00571: ===========================================================\nRMAN-06433: error installing recovery catalog\nRMAN Client Diagnostic Trace file : \/u01\/app\/oracle\/diag\/clients\/user_oracle\/RMAN_1732619876_110\/trace\/ora_rman_635844_0.trc\n<\/pre><\/div>\n\n\n<p>To create a valid rman catalog, you need to grant the execute right for UTL_HTTP, DBMS_LOB, DBMS_XMLGEN and DBMS_SQL directly to the rman user. Strange for me: it does not work if you grant it to a role (e.g. recovery_catalog_owner), but it works with a grant to public.<\/p>\n\n\n\n<p>My recommendation to install new softare or patches is:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Run the undo-script mentioned above (grant execute to public)<\/li>\n\n\n\n<li>Apply the Oracle or application patch or new application installation<\/li>\n\n\n\n<li>Check for invalid objects<\/li>\n\n\n\n<li>Run the hardening-script (revoke execute from public)<\/li>\n\n\n\n<li>Check for additional invalid objects and determine the missing grants<\/li>\n\n\n\n<li>Extend your hardening script with the required grants and re-run it.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-conclusion\">Conclusion<\/h2>\n\n\n\n<p>Generally, the CIS hardening about revoking execute from public is possible. But it is very dangerous that the functionality of the application could be compromised. Especially with components that are used very rarely, this could only be noticed very late at best, e.g. in the case of end-of-year processing.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CIS recommendations The Center for Internet Security publishes the &#8220;CIS Oracle database 19c Benchmark&#8221; with recommendations to enhance the security of Oracle databases. One type of recommendations is to remove grant execute to public (chapter 5.1.1.1-5.1.1.7 Public Privileges). There is a list of powerful SYS packages. And for security reasons, only users that really need [&hellip;]<\/p>\n","protected":false},"author":123,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[229,59,149],"tags":[],"type_dbi":[],"class_list":["post-40309","post","type-post","status-publish","format-standard","hentry","category-database-administration-monitoring","category-oracle","category-security"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Remove grant to public in Oracle databases - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Remove grant to public in Oracle databases\" \/>\n<meta property=\"og:description\" content=\"CIS recommendations The Center for Internet Security publishes the &#8220;CIS Oracle database 19c Benchmark&#8221; with recommendations to enhance the security of Oracle databases. One type of recommendations is to remove grant execute to public (chapter 5.1.1.1-5.1.1.7 Public Privileges). There is a list of powerful SYS packages. And for security reasons, only users that really need [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-03-16T14:18:48+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-23T13:31:31+00:00\" \/>\n<meta name=\"author\" content=\"Martin Bracher\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Martin Bracher\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/\"},\"author\":{\"name\":\"Martin Bracher\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/86cb065eea74ac30961c4cc45ce56c9e\"},\"headline\":\"Remove grant to public in Oracle databases\",\"datePublished\":\"2026-03-16T14:18:48+00:00\",\"dateModified\":\"2026-03-23T13:31:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/\"},\"wordCount\":804,\"commentCount\":0,\"articleSection\":[\"Database Administration &amp; Monitoring\",\"Oracle\",\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/\",\"name\":\"Remove grant to public in Oracle databases - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\"},\"datePublished\":\"2026-03-16T14:18:48+00:00\",\"dateModified\":\"2026-03-23T13:31:31+00:00\",\"author\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/86cb065eea74ac30961c4cc45ce56c9e\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.dbi-services.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Remove grant to public in Oracle databases\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/86cb065eea74ac30961c4cc45ce56c9e\",\"name\":\"Martin Bracher\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/864a93d77bcd4cd44bab880a88f25fb5173ffbfac8e6e8775f0b4e056a4fbb56?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/864a93d77bcd4cd44bab880a88f25fb5173ffbfac8e6e8775f0b4e056a4fbb56?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/864a93d77bcd4cd44bab880a88f25fb5173ffbfac8e6e8775f0b4e056a4fbb56?s=96&d=mm&r=g\",\"caption\":\"Martin Bracher\"},\"url\":\"https:\/\/www.dbi-services.com\/blog\/author\/martinbracher\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Remove grant to public in Oracle databases - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/","og_locale":"en_US","og_type":"article","og_title":"Remove grant to public in Oracle databases","og_description":"CIS recommendations The Center for Internet Security publishes the &#8220;CIS Oracle database 19c Benchmark&#8221; with recommendations to enhance the security of Oracle databases. One type of recommendations is to remove grant execute to public (chapter 5.1.1.1-5.1.1.7 Public Privileges). There is a list of powerful SYS packages. And for security reasons, only users that really need [&hellip;]","og_url":"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/","og_site_name":"dbi Blog","article_published_time":"2026-03-16T14:18:48+00:00","article_modified_time":"2026-03-23T13:31:31+00:00","author":"Martin Bracher","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Martin Bracher","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/"},"author":{"name":"Martin Bracher","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/86cb065eea74ac30961c4cc45ce56c9e"},"headline":"Remove grant to public in Oracle databases","datePublished":"2026-03-16T14:18:48+00:00","dateModified":"2026-03-23T13:31:31+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/"},"wordCount":804,"commentCount":0,"articleSection":["Database Administration &amp; Monitoring","Oracle","Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/","url":"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/","name":"Remove grant to public in Oracle databases - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"datePublished":"2026-03-16T14:18:48+00:00","dateModified":"2026-03-23T13:31:31+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/86cb065eea74ac30961c4cc45ce56c9e"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/remove-grant-to-public-in-oracle-databases\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Remove grant to public in Oracle databases"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/86cb065eea74ac30961c4cc45ce56c9e","name":"Martin Bracher","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/864a93d77bcd4cd44bab880a88f25fb5173ffbfac8e6e8775f0b4e056a4fbb56?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/864a93d77bcd4cd44bab880a88f25fb5173ffbfac8e6e8775f0b4e056a4fbb56?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/864a93d77bcd4cd44bab880a88f25fb5173ffbfac8e6e8775f0b4e056a4fbb56?s=96&d=mm&r=g","caption":"Martin Bracher"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/martinbracher\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/40309","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/123"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=40309"}],"version-history":[{"count":12,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/40309\/revisions"}],"predecessor-version":[{"id":43518,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/40309\/revisions\/43518"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=40309"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=40309"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=40309"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=40309"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}