6 DBFS SecureFiles Store

You must use a regular database user for all operational access to the Content API and stores.

Do not use SYS or SYSTEM users or SYSDBA or SYSOPER system privileges. For better security and separation of duty, only allow specific trusted users the ability to manage DBFS Content API operations.

You must grant each user the DBFS_ROLE role. Otherwise, the user is not authorized to use the DBFS Content API. A user with suitable administrative privileges (or SYSDBA) can grant the role to additional users as needed.

Because of the way roles, access control, and definer and invoker rights interact in the database, it may be necessary to explicitly grant various permissions (typically execute permissions) on DBFS Content API types (SQL types with the DBMS_DBFS_CONTENT_ xxx prefix) and packages (typically only DBMS_DBFS_CONTENT and DBMS_DBFS_SFS) to users who might otherwise have the DBFS_ROLE role.

These explicit, direct grants are normal and to be expected, and can be provided as needed and on demand.

You must grant the DBFS_ROLE role to any user that needs to use the DBFS content API.

1. Create or determine DBFS Content API target users.

   This example uses this user and password: sfs_demo/password

   At minimum, this database user must have the CREATE SESSION, CREATE RESOURCE, and CREATE VIEW privileges.

2. Grant the DBFS_ROLE role to the user.

   CONNECT / as sysdba
   GRANT dbfs_role TO sfs_demo;
   

You must create the SecureFiles file system stores that the DBFS Content API accesses.

1. Create the necessary stores to be accessed using the DBFS Content API:

   DECLARE
     BEGIN
       DBMS_DBFS_SFS.CREATEFILESYSTEM(
         store_name => 'FS1',
         tbl_name => 'T1',
         tbl_tbs => null,
         use_bf => false 
       );
       COMMIT;
     END;
   /
   

   where:

   • store_name is any arbitrary, user-unique name.

   • tbl_name is a valid table name, created in the current schema.

   • tbl_tbs is a valid tablespace name used for the store table and its dependent segments, such as indexes, LOBs, or nested tables. The default is NULL and specifies a tablespace of the current schema.

   • use_bf specifies that BasicFiles LOBs should be used, if true, or not used, if false.

2. Register this store with the DBFS Content API as a new store managed by the SecureFiles Store provider.

   CONNECT sfs_demo
   Enter password:password
   DECLARE
     BEGIN
       DBMS_DBFS_CONTENT.REGISTERSTORE(
         store_name    => 'FS1',
         provider_name => 'anything',
         provider_package => 'dbms_dbfs_sfs'
       );
       COMMIT;
     END;
   /
   

   where:

   • store_name is SecureFiles Store FS1, which uses table SFS_DEMO.T1.

   • provider_name is ignored.

   • provider_package is DBMS_DBFS_SFS, for SecureFiles Store reference provider.

   This operation associates the SecureFiles Store FS1 with the DBMS_DBFS_SFS provider.

3. Mount the store at suitable a mount-point.

   CONNECT sfs_demo
   Enter password: password
   DECLARE
     BEGIN
       DBMS_DBFS_CONTENT.MOUNTSTORE(
         store_name    => 'FS1',
         store_mount   => 'mnt1'
       );
       COMMIT;
     END;
   /
   

   where:

   • store_name is SecureFiles Store FS1, which uses table SFS_DEMO.T1.

   • store_mount is the mount point.

4. [Optional] To see the results of the preceding steps, you can use the following statements.

   • To verify SecureFiles Store tables and file systems:

     SELECT * FROM TABLE(DBMS_DBFS_SFS.LISTTABLES);
     SELECT * FROM TABLE(DBMS_DBFS_SFS.LISTFILESYSTEMS);
     

   • To verify ContentAPI Stores and mounts:

     SELECT * FROM TABLE(DBMS_DBFS_CONTENT.LISTSTORES);
     SELECT * FROM TABLE(DBMS_DBFS_CONTENT.LISTMOUNTS);
      

   • To verify SecureFiles Store features:

     var fs1f number;
     exec :fs1f := dbms_dbfs_content.getFeaturesByName('FS1');
     select * from table(dbms_dbfs_content.decodeFeatures(:fs1f)); 
     

   • To verify resource and property views:

     SELECT * FROM DBFS_CONTENT;
     SELECT * FROM DBFS_CONTENT_PROPERTIES;
     

You should never directly access tables that hold data for a SecureFiles Store file systems, even through the DBMS_DBFS_SFS package methods.

You can truncate and re-initialize tables associated with an SecureFiles Store.

CONNECT sfs_demo;
Enter password: password
EXEC DBMS_DBFS_SFS.INITFS(store_name => 'FS1');

SecureFiles LOBs are only available in Oracle Database 11g Release 1 and higher. They are not available in earlier releases.

You must use BasicFiles LOB storage for LOB storage in tablespaces that are not managed with Automatic Segment Space Management (ASSM).

Compatibility must be at least 11.1.0.0 to use SecureFiles LOBs.

Additionally, you need to specify the following in DBMS_DBFS_SFS.CREATEFILESYSTEM:

• To use SecureFiles LOBs (the default), specify use_bf => false.

• To use BasicFiles LOBs, specify use_bf => true.

You can create new file and directory elements to populate a SecureFiles Store file system.

If you have executed the steps in "Setting Up a SecureFiles Store", set the DBFS Content API permissions, created at least one SecureFiles Store reference file system, and mounted it under the mount point /mnt1, then you can create a new file and directory elements as demonstrated in Example 6-1.

CONNECT tjones
Enter password: password
 
DECLARE
   ret integer;
   b   blob;
   str varchar2(1000)  := '' || chr(10) ||
 
'#include <stdio.h>' || chr(10) ||
'' || chr(10) ||
'int main(int argc, char** argv)' || chr(10) ||
'{' || chr(10) ||
'    (void) printf("hello world\n");' || chr(10) ||
'    RETURN 0;' || chr(10) ||
'}' || chr(10) ||
'';
 
    BEGIN
        ret := dbms_fuse.fs_mkdir('/mnt1/FS1');
        ret := dbms_fuse.fs_creat('/mnt1/FS1/hello.c', content => b);
        dbms_lob.writeappend(b, length(str), utl_raw.cast_to_raw(str));
        COMMIT;
    END;
    /
    SHOW ERRORS;
 
    -- verify newly created directory and file
    SELECT pathname, pathtype, length(filedata),
        utl_raw.cast_to_varchar2(filedata)
        FROM dbfs_content
            WHERE pathname LIKE '/mnt1/FS1%'
            ORDER BY pathname;

You can use the unmountStore method to drop SecureFiles Store file systems.

1. Unmount the store.

   CONNECT sfs_demo
   Enter password: password
   DECLARE
     BEGIN
       DBMS_DBFS_CONTENT.UNMOUNTSTORE(
         store_name    => 'FS1',
         store_mount   => 'mntl';
       );
       COMMIT;
   END;
   /
   

   where:

   • store_name is SecureFiles Store FS1, which uses table SFS_DEMO.T1.

   • store_mount is the mount point.

2. Unregister the stores.

   CONNECT sfs_demo
   Enter password: password
   EXEC DBMS_DBFS_CONTENT.UNREGISTERSTORE(store_name => 'FS1');
   COMMIT;
   

   where store_name is SecureFiles Store FS1, which uses table SFS_DEMO.T1.

3. Drop the file system.

   CONNECT sfs_demo/******;
   EXEC DBMS_DBFS_SFS.DROPFILESYSTEM(store_name => 'FS1');
   COMMIT;
   

   where store_name is SecureFiles Store FS1, which uses table SFS_DEMO.T1.