Note
This variable is available starting with V2.2.77.
Description
secure_file_priv specifies the path that can be accessed when importing or exporting data to a file.
Note
The log/alert directory is in the allowlist of file access permissions for the sys tenant. Therefore, the directory can be skipped when checking the secure_file_priv variable.
Notice
Due to security reasons, only a client that connects to OceanBase Database through a local Unix socket can execute an SQL statement to modify this global variable.
Privilege requirements
Query variables
The
systenant and all user tenants can execute theSHOW VARIABLESstatement or query theSYS.TENANT_VIRTUAL_GLOBAL_VARIABLEview (Oracle mode) or theinformation_schema.GLOBAL_VARIABLESview (MySQL mode) to view the value of global system variables.Modify variables
Global level
The
systenant can directly modify the value of global system variables.A MySQL user tenant must have the
SUPERorALTER SYSTEMprivilege to modify the value of global system variables.An Oracle user tenant must have the
ALTER SYSTEMprivilege to modify the value of global system variables.
Attributes
| Attribute | Description |
|---|---|
| Parameter type | Varchar |
| Default value | "" indicates an empty string.
NoteStarting from V4.2.1, the default value is changed from |
| Value range |
NoteStarting from V4.2.0, the meaning of the enumeration values |
| Scope | Global |
| Modifiable | Yes. You can execute the SET statement to modify the value. |
| Nullable | Yes |
Usage notes
You can connect to OceanBase Database only through a local Unix socket.
obclient -S /home/admin/oceanbase/run/sql.sock -u******@obtenant -p******
If the current user is different from the user that started the OBServer node, the current user does not have the sql.sock file permission. You must use the following command to connect to OceanBase Database.
sudo -u <user of observer> obclient -S /home/admin/oceanbase/run/sql.sock -u******@obtenant -p******
The parameters are described as follows:
- -S: the path of the Unix socket file of the local OBServer node. The Unix socket file is located in the installation directory of the local OBServer node, and the default path is
/home/admin/oceanbase/run/sql.sock. - -u: the tenant connection account, in the format of
username@tenant name.
When you connect to OceanBase Database through a Unix socket, you can only connect to the local OBServer node. You must also ensure that the resources of the tenant are distributed on the local OBServer node. If the resources of the tenant are not distributed on the local OBServer node, you cannot connect to the tenant through the local OBServer node.
Examples
Set the path that can be accessed when importing or exporting data to a file to "".
obclient> SET GLOBAL secure_file_priv = "";