TMA-DB2-6.2.6
Review Role Grantees with WITH ADMIN OPTION
Description
Using the WITH ADMIN OPTION clause of the GRANT (Role) SQL statement, the security administrator can delegate the management and control of membership in a role to someone else.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
1. Connect to Db2 database: db2 => connect to <dbname> 2. Perform the following query: db2 => select rolename, grantee, admin from syscat.roleauth where grantortype <> 'S' and admin = 'Y' If the value returned is blank, that is considered a Pass.
How it is fixed
Fix method: Guidance or infrastructure patch
1. Connect to Db2 database: db2 => connect to <dbname> 2. Perform the following query: db2 => revoke admin option for role <role name> from user <user name>
Properties
- Operating systems
- Any
- Tags
- db2databasemanual
- Reference
- CIS IBM Db2 12.1 Benchmark v1.0.0 - 6.2.6 Review Role Grantees with WITH ADMIN OPTION