SYSDBA can grant non existent roles [CORE196] #523
Description
Submitted by: Claudio Valderrama C. (robocop)
SFID: 223128#
Submitted By: robocop
IB doesn't check the user in a GRANT statement probably because the db can be moved to another server where such user is defined, since the information is stored in isc4.gdb only.
But why would IB allow SYSDBA to grant no existent roles to users? For example, this is accepted:
grant anything to alice
However, "anything" doesn't exist in rdb$roles but rdb$user_privileges logs a role granted to alice.
In contrast, a non-privileged user can't grant a role that doesn't exists. So I wonder is this is a bug or a feature. Why would SYSDBA need to bypass role checking when grating roles to users?
C.