Note
This variable was introduced in OceanBase Database V2.2.77.
Description
secure_file_priv specifies the directory that can be accessed for file import or export. This variable can be specified only by the database administrator (DBA).
Note
The log/alert directory is included in the file access allowlist for the sys tenant, meaning it can be accessed even if not specified by secure_file_priv, so you can skip this directory in the secure_file_priv privilege check.
Notice
For security reasons, an SQL statement that modifies this global variable can only be executed by a client connected by using a local Unix socket.
Limitations
Query the variable
In the
systenant or a user tenant, you can execute theSHOW VARIABLESstatement to query the variable at the global level or query theSYS.TENANT_VIRTUAL_GLOBAL_VARIABLEview (in Oracle mode) orinformation_schema.GLOBAL_VARIABLESview (in MySQL mode) for the variable at the global level.Modify the variable
Global-level operation
In the
systenant, you can directly change the value of the variable at the global level.In a MySQL user tenant, you must have the
SUPERorALTER SYSTEMprivilege to change the value of the variable at the global level.In OceanBase Database V4.2.0 and later V4.x versions, you must have the
ALTER SYSTEMprivilege to change the value of the variable at the global level in an Oracle user tenant.
Attributes
| Attribute | Description |
|---|---|
| Type | Varchar |
| Default value | "", which indicates an empty string
NoteThe default value is changed from |
| Value range |
NoteIn OceanBase Database V4.2.0 and later, the meanings of an empty string and the value |
| Effective scope | Global |
| Modifiable | Yes. You can use the SET statement to modify the variable. |
| Plan generation affected | Yes |
| Nullable | Yes |
Considerations
You can connect to OceanBase Database only by using a local Unix socket.
obclient -S /home/admin/oceanbase/run/sql.sock -u******@obtenant -p******
If the current user is not the OBServer node startup user, the current user does not have the privilege on the sql.sock file. In this case, you can execute the following statement to connect to OceanBase Database:
sudo -u <user of observer> obclient -S /home/admin/oceanbase/run/sql.sock -u******@obtenant -p******
where:
- -S specifies the path to the Unix socket file for the local OBServer node. The file is named
sql.sockand is in therun/directory in the local OBServer node installation directory. The default value is/home/admin/oceanbase/run/sql.sock. - -u specifies the tenant account name in the
username@tenant nameformat.
You can connect to only a local OBServer node by using a Unix socket connection. Make sure that the resources of the tenant are distributed on the local OBServer node. Otherwise, you cannot connect to the tenant by using the local OBServer node.
Examples
Set the directory that can be accessed for file import or export to an empty string.
obclient> SET GLOBAL secure_file_priv = "";