system_protected_tenant_parameters

Description

system_protected_tenant_parameters specifies the list of locked tenant-level parameters. The tenant-level parameters in this list cannot be modified by ordinary users.

Privilege requirements

• Query the parameter

  The sys tenant and all user tenants can query this parameter by using the SHOW PARAMETERS statement or the GV$OB_PARAMETERS view.

• Modify the parameter

  Only the sys tenant can modify this parameter. User tenants cannot modify this parameter.

Attributes

Considerations

• To prevent ordinary users from modifying tenant-level parameters, add the parameter names to this parameter. After the parameter names are added, ordinary users (including those with Super privileges) cannot modify the parameters. Only the SYS (Oracle mode) or ROOT (MySQL mode) user can modify the parameters.

• Parameter value specification:

  Separate the parameter names with commas. The parameter names are case-insensitive. Do not add spaces before or after the commas. Do not start or end with a comma. The format is "para1" or "para1,...,paran"

  Allowed examples:

  • "param1"
  • "param1,param2"
  • "param1,param2,param3"

  Not allowed examples:

  • ","
  • "param1,"
  • "param1, param2" (space after the comma)
  • "param1,param2,"

Examples

Add the backup_dest parameter to the protected list:

obclient> ALTER SYSTEM SET system_protected_tenant_parameters = "backup_dest";

Protect multiple tenant-level parameters:

obclient> ALTER SYSTEM SET system_protected_tenant_parameters = "backup_dest,sts_credential";

Clear the protected list (allow all ordinary users to modify tenant-level parameters):

obclient> ALTER SYSTEM SET system_protected_tenant_parameters = "";