Note
This variable was introduced in V2.2.77.
Description
The secure_file_priv variable specifies the path that can be accessed when you import or export data to or from a file. Only database administrators can set this variable. Other users cannot set it.
Note
The log/alert directory is included in the file access permission whitelist of the system tenant. Therefore, the secure_file_priv permission check can skip this directory.
Notice
For security reasons, you can execute an SQL statement to modify the value of this global variable only by using a client that is connected to the server through a local Unix socket.
Privilege requirements
Query variables
Users in the
systenant and all user tenants can execute theSHOW VARIABLESstatement or view the values of global system variables in theSYS.TENANT_VIRTUAL_GLOBAL_VARIABLEview (in Oracle mode) and theinformation_schema.GLOBAL_VARIABLESview (in MySQL mode).Modify variables
Set the variable at the global level
Users in the
systenant can directly modify the value of a global system variable.MySQL users need the
SUPERorALTER SYSTEMprivilege to modify the value of a global system variable.For V4.x, Oracle users need the
ALTER SYSTEMprivilege to modify the value of a global system variable starting from V4.2.0.
Attributes
| Attribute | Description |
|---|---|
| Type | Varchar |
| Default value | "" (empty string).
NoteStarting from V4.2.1, the default value is adjusted from |
| Value range |
NoteStarting from V4.2.0, the meanings of the |
| Scope | GLOBAL |
| Modifiable | Yes. You can modify it by using the SET statement. |
| Nullable | Yes |
Considerations
You can connect to OceanBase Database only through a local Unix socket.
obclient -S /home/admin/oceanbase/run/sql.sock -u******@obtenant -p******
If the current user is different from the user that started the OBServer, the current user does not have the sql.sock permission. You can run the following command to connect.
sudo -u <user of observer> obclient -S /home/admin/oceanbase/run/sql.sock -u******@obtenant -p******
The parameters are described as follows:
- -S: specifies the path of the Unix socket file of the local OBServer node. The default Unix socket file path is
/home/admin/oceanbase/run/sql.sock. The Unix socket file is located in the run directory of the local OBServer installation directory. - -u: specifies the account for connecting to the tenant, in the format of
username@tenant name.
When you connect through a Unix socket, you can connect only to the local OBServer node. At the same time, the resources of the tenant must be distributed on the local OBServer node. If the resources of the tenant are not distributed on the local OBServer node, you cannot connect to the tenant through the local OBServer node.
Examples
Set the path that can be accessed when you import or export data to or from a file to "".
obclient> SET GLOBAL secure_file_priv = "";