GRANT System Object Permissions (Transact-SQL)

  • Article

Grants permissions on system objects such as stored procedures, extended stored procedures, functions, and views.

Topic link iconTransact-SQL Syntax Conventions

Syntax

GRANT { SELECT | EXECUTE } ON [ sys.]system_object TO principal

Arguments

  • [ sys.] .
    The sys qualifier is required only when you are referring to catalog views and dynamic management views.
  • system_object
    Specifies the object on which permission is being granted.
  • principal
    Specifies the principal to which the permission is being granted.

Remarks

This statement can be used to grant permissions on certain stored procedures, extended stored procedures, table-valued functions, scalar functions, views, catalog views, compatibility views, INFORMATION_SCHEMA views, dynamic management views, and system tables that are installed by SQL Server 2005. Each of these system objects exists as a unique record in the resource database of the server (mssqlsystemresource). The resource database is read-only. A link to the object is exposed as a record in the sys schema of every database. Permission to execute or select a system object can be granted, denied, and revoked.

Granting permission to execute or select an object does not necessarily convey all the permissions required to use the object. Most objects perform operations for which additional permissions are required. For example, a user that is granted EXECUTE permission on sp_addlinkedserver cannot create a linked server unless the user is also a member of the sysadmin fixed server role.

Default name resolution resolves unqualified procedure names to the resource database. Therefore, the sys qualifier is only required when you are specifying catalog views and dynamic management views.

Granting permissions on triggers and on columns of system objects is not supported.

Permissions on system objects will be preserved during upgrades of SQL Server.

System objects are visible in the sys.system_objects catalog view. The permissions on system objects are visible in the sys.database_permissions catalog view in the master database.

The following query returns information about permissions of system objects:

SELECT * FROM master.sys.database_permissions AS dp 
    JOIN sys.system_objects AS so
    ON dp.major_id = so.object_id
    WHERE dp.class = 1 AND so.parent_object_id = 0 ;
GO

Permissions

Requires CONTROL SERVER permission.

Examples

A. Granting SELECT permission on a view

The following example grants the SQL Server login Smacrae permission to select a view that lists SQL Server logins. The example then grants the additional permission that is required to view metadata on SQL Server logins that are not owned by the user.

USE AdventureWorks;
GRANT SELECT ON sys.sql_logins TO Smacrae;
GRANT VIEW SERVER STATE to Smacrae;
GO

B. Granting EXECUTE permission on an extended stored procedure

The following example grants EXECUTE permission on xp_readmail to Smacrae.

GRANT EXECUTE ON xp_readmail TO Smacrae;
GO

See Also

Reference

sys.system_objects (Transact-SQL)
sys.database_permissions (Transact-SQL)
REVOKE System Object Permissions (Transact-SQL)
DENY System Object Permissions (Transact-SQL)

Help and Information

Getting SQL Server 2005 Assistance

Change History

Release History

17 July 2006
New content:
  • Added example of granting permission to execute a system object.