Review Roles Granted to PUBLIC

MediumLevel 1Manual reviewdb2

Description

Granting to PUBLIC increases the risk of unauthorized entry into the database. Because PUBLIC is accessible by any database user, it is important to understand the exposure it has on all database objects. It would make sense to grant role membership to PUBLIC if all users required all the privileges granted through that role.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

1. Connect to Db2 database: db2 => connect to <dbname> 2. Run the following: db2 => select grantee, rolename from syscat.roleauth where grantee = 'PUBLIC' If the value returned is blank, that is considered a Pass.

How it is fixed

Fix method: Guidance or infrastructure patch

To remove a role member from a particular role: 1. Connect to Db2 database: db2 => connect to <dbname> 2. Run the following: db2 => revoke role <role name> from PUBLIC

Properties

Operating systems: Any
Tags: db2databasemanual
Reference: CIS IBM Db2 12.1 Benchmark v1.0.0 - 6.2.5 Review Roles Granted to PUBLIC