NonStop SQL/MP Reference Manual

NonStop SQL/MP Reference Manual—142115
A-8
Considerations—ALTER CATALOG
The clauses set the following security-related file attributes for the catalog:
For more information, see the System Catalog
on page S-91 entry or an entry for a
specific attribute.
Considerations—ALTER CATALOG
•
Authorization requirements
To alter security attributes for a catalog, you must be a generalized owner of the
catalog.
Only one DDL statement can operate on a given SQL object (or partition of an SQL
object) at a time. An error occurs if you attempt to execute an ALTER CATALOG
statement while another process is executing a DDL operation on an object in the
catalog.
The specific error depends on the DDL operation involved and the phase of the
operation at which the conflict occurs. (See DDL (Data Definition Language)
Statements on page D-19 for more information.)
•
Storage of security information
Security information for a catalog is stored in the catalog tables and file labels for
the catalog. ALTER CATALOG changes the information in the catalog and in the
associated file labels on disk.
•
Catalog security
Changing ownership or security for a catalog can affect users of objects described in
the catalog, so be careful when you narrow the set of users with read or write access.
If you remove a user's authority to read or write to a catalog, the user cannot query,
alter, or drop an object in the catalog (even if the user owns the object), or recompile
a program that uses an object in the catalog.
SQL-compiling a program requires the authority to write to the PROGRAMS,
USAGES, and TRANSIDS catalog tables in the catalog that contains the description
of the program and to the USAGES and TRANSIDS catalog tables in any catalogs
that contain descriptions of tables or views used by the program. Because of this
requirement, you might want to secure these catalog tables independently from other
catalog tables. You can use ALTER TABLE to set the security for the PROGRAMS,
USAGES, and TRANSIDS tables.
Creating or dropping a catalog requires the authority to write to the system directory
of catalogs in the SQL.CATALOGS table, therefore altering write authority for
SQL.CATALOGS can prevent users from creating new catalogs or dropping existing
catalogs. Because of this requirement, you might want to secure SQL.CATALOGS
CLEARONPURGE Controls disk erasure when files are dropped
NOPURGEUNTIL Sets date after which drop is allowed
OWNER Specifies owner
SECURE Sets Guardian security string