User can access stored procedure, but not the underlying code directly - sql

Question

I want to create a stored procedure SP1 which will have script to fetch data from sys schema. But this stored procedure would be called by users who do not have permissions on the sys schema. How can I achieve this?
I am doing this basically to mask the entire sys schema from that user but at the same time allowing him to see minimal info.
Basically I want this inside SP
--Displays Object information
SELECT m.object_id [ObjID]
,o.type_desc [ObjType]
,o.name [ObjectName]
,e.last_execution_time [LastExecutedOn]
,create_date [CreatedOn]
,modify_date [ModifiedOn]
, DEFINITION [Data]
FROM sys.SQL_MODULES m
JOIN sys.OBJECTS o
ON m.object_id=o.object_id
LEFT JOIN sys.dm_exec_procedure_stats e
ON e.object_id=o.object_id
WHERE DEFINITION LIKE '%'+#SearchStr+'%'
ORDER BY o.name

Answer 1

I believe you could achieve this with a View rather than an SP, as per this question.
If you need to be able to pass a parameter as well for your #SearchStr variable, you could create an SP which queries the view accordingly. So your View would be:
CREATE VIEW vwObjectInfo
AS
SELECT m.OBJECT_ID [ObjID],
o.type_desc [ObjType],
o.name [ObjectName],
e.last_execution_time [LastExecutedOn],
create_date [CreatedOn],
modify_date [ModifiedOn],
[definition] [Data]
FROM sys.SQL_MODULES m
JOIN sys.OBJECTS o ON m.OBJECT_ID = o.OBJECT_ID
LEFT JOIN sys.dm_exec_procedure_stats e ON e.OBJECT_ID = o.OBJECT_ID
and your SP would be:
CREATE PROCEDURE spSearchObjectInfo
#SearchStr NVARCHAR(MAX)
AS
BEGIN
SELECT * FROM vwObjectInfo
WHERE Data LIKE '%' + #SearchStr + '%'
ORDER BY ObjectName
END
Your user should then be able to call the SP with their desired search string and get results with just the ability to SELECT from the View and EXECUTE the SP, like so:
EXEC spSearchObjectInfo 'Some Search String'