Question about JAVAUSERPRIV privilege
I have been assigned to grant the necessary privileges to an Oracle user to manage the filesystem through database with JAVA. The user should have access to a specified partition only.
I have been looking into the privilege JAVAUSERPRIV and the permissions granted to this privilege.
Among others it includes the below:
exec dbms_java.grant_permission('USER', 'java.io.FilePermission', '<<ALL FILES>>', 'read');
But it does not include the below:
exec dbms_java.grant_permission('USER', 'SYS:java.lang.RuntimePermission', 'readFileDescriptor', '');
My question is:
After granting JAVAUSERPRIV to USER, does he get access to read the whole filesystem, since he is not granted the second command?