System Table Security in SQL Server 2005
I ran into an interesting issue today while working with SQL Server 2005 Beta 2 CTP December 2004. It would appear that Microsoft has greatly restricted permissions, even SELECTing from master system tables. Here's the situation we had.
TableA in user DatabaseZ had an insert/update trigger to insert into TableB in DatabaseY, but only if the context_info from master..sysprocesses was not = 1, which was set to 1 if the application set the context_info when it logged in. (Yeah, I know this should really be added to http://thedailywtf.com/). When the trigger tried to SELECT from sysprocesses the user calling did not have permission to read the table, thus causing an error.
To correct this we (thanks to Bruce Nation and Peter Watson) changed the trigger to use the new context_info() function instead of selecting from sysprocesses.
We still have not determined if this is just a broken permissions chain or if MSFT just won't allow this. We were not able to GRANT to the system tables in master, and we weren't able to wrap them in views, SPs, or functions either. It just appears that MSFT doesn't want us using the system tables for ANYTHING anymore.
If anyone has additional insight into this problem, posts would be appreciated.
TableA in user DatabaseZ had an insert/update trigger to insert into TableB in DatabaseY, but only if the context_info from master..sysprocesses was not = 1, which was set to 1 if the application set the context_info when it logged in. (Yeah, I know this should really be added to http://thedailywtf.com/). When the trigger tried to SELECT from sysprocesses the user calling did not have permission to read the table, thus causing an error.
To correct this we (thanks to Bruce Nation and Peter Watson) changed the trigger to use the new context_info() function instead of selecting from sysprocesses.
We still have not determined if this is just a broken permissions chain or if MSFT just won't allow this. We were not able to GRANT to the system tables in master, and we weren't able to wrap them in views, SPs, or functions either. It just appears that MSFT doesn't want us using the system tables for ANYTHING anymore.
If anyone has additional insight into this problem, posts would be appreciated.
