I was a bit surprised that one can’t revoke access to any of the functions under the system defined SYSIBM and SYSFUN schemas. Although these are system defined, it seems strange that DB2 does not allow revoking access to any of them. For example, there is a function called ‘GET_DBM_CONFIG’ in 8.2 which gives a lot of configuration related information to PUBLIC and you can’t revoke access to it.

db2 => revoke execute on sysfun.get_dbm_config from test
DB21034E  The command was processed as an SQL statement because it was not a
valid Command Line Processor command.  During SQL processing it returned:
SQL0204N  "SYSFUN.GET_DBM_CONFIG" is an undefined name.  SQLSTATE=42704



Ref - http://publib.boulder.ibm.com/infocenter/db2luw/v8/topic/com.ibm.db2.udb.doc/admin/r0007699.htm