> What if the database, and the objects and privileges, were created by
> SYSDBA, prior to creating the role SYSDBA? That would be catch-22, I think....

You can't create SYSDBA role if there already are objects owned by SYSDBA
(or grants to SYSDBA). Try it.

Ivan