There are certain procedures for setting up and using a DBFS SecureFiles Store.
Topics:
There are several aspects to setting up a SecureFiles Store.
This section shows how to set up a SecureFiles Store.
Topics:
You must use a regular database user for all operational access to the Content API and stores.
Do not use SYS
or SYSTEM
users or SYSDBA
or SYSOPER
system privileges. For better security and separation of duty, only allow specific trusted users the ability to manage DBFS Content API operations.
You must grant each user the DBFS_ROLE
role. Otherwise, the user is not authorized to use the DBFS Content API. A user with suitable administrative privileges (or SYSDBA
) can grant the role to additional users as needed.
Because of the way roles, access control, and definer and invoker rights interact in the database, it may be necessary to explicitly grant various permissions (typically execute permissions) on DBFS Content API types (SQL types with the DBMS_DBFS_CONTENT_
xxx
prefix) and packages (typically only DBMS_DBFS_CONTENT
and DBMS_DBFS_SFS
) to users who might otherwise have the DBFS_ROLE
role.
These explicit, direct grants are normal and to be expected, and can be provided as needed and on demand.
You must grant the DBFS_ROLE
role to any user that needs to use the DBFS content API.
This sets up the DBFS Content API for any database user who has the DBFS_ROLE
role.
You must create the SecureFiles file system stores that the DBFS Content API accesses.
The CREATEFILESYSTEM
procedure auto-commits before and after its execution (like a DDL). The method CREATESTORE
is a wrapper around CREATEFILESYSTEM
.
See Oracle Database PL/SQL Packages and Types Reference for DBMS_DBFS_SFS
syntax details.
To create a SecureFiles File System Store:
You should never directly access tables that hold data for a SecureFiles Store file systems, even through the DBMS_DBFS_SFS
package methods.
This is the correct way to access the file systems.
For procedural operations: Use the DBFS Content API (DBMS_DBFS_CONTENT
methods).
For SQL operations: Use the resource and property views (DBFS_CONTENT
and DBFS_CONTENT_PROPERTIES
).
You can truncate and re-initialize tables associated with an SecureFiles Store.
Use the procedure INITFS()
.
The procedure executes like a DDL, auto-committing before and after its execution.
The following example uses file system FS1
and table SFS_DEMO
.T1
, which is associated with the SecureFiles Store store_name
.
CONNECT sfs_demo; Enter password: password EXEC DBMS_DBFS_SFS.INITFS(store_name => 'FS1');
SecureFiles LOBs are only available in Oracle Database 11g Release 1 and higher. They are not available in earlier releases.
You must use BasicFiles LOB storage for LOB storage in tablespaces that are not managed with Automatic Segment Space Management (ASSM).
Compatibility must be at least 11.1.0.0 to use SecureFiles LOBs.
Additionally, you need to specify the following in DBMS_DBFS_SFS.CREATEFILESYSTEM:
To use SecureFiles LOBs (the default), specify use_bf => false.
To use BasicFiles LOBs, specify use_bf => true
.
The DBFS Content API provides methods to populate a SecureFiles Store file system and otherwise manage it.
Topics:
You can create new file and directory elements to populate a SecureFiles Store file system.
If you have executed the steps in "Setting Up a SecureFiles Store", set the DBFS Content API permissions, created at least one SecureFiles Store reference file system, and mounted it under the mount point /mnt1
, then you can create a new file and directory elements as demonstrated in Example 6-1.
Example 6-1 Working with DBFS Content API
CONNECT tjones Enter password: password DECLARE ret integer; b blob; str varchar2(1000) := '' || chr(10) || '#include <stdio.h>' || chr(10) || '' || chr(10) || 'int main(int argc, char** argv)' || chr(10) || '{' || chr(10) || ' (void) printf("hello world\n");' || chr(10) || ' RETURN 0;' || chr(10) || '}' || chr(10) || ''; BEGIN ret := dbms_fuse.fs_mkdir('/mnt1/FS1'); ret := dbms_fuse.fs_creat('/mnt1/FS1/hello.c', content => b); dbms_lob.writeappend(b, length(str), utl_raw.cast_to_raw(str)); COMMIT; END; / SHOW ERRORS; -- verify newly created directory and file SELECT pathname, pathtype, length(filedata), utl_raw.cast_to_varchar2(filedata) FROM dbfs_content WHERE pathname LIKE '/mnt1/FS1%' ORDER BY pathname;
The file system can be populated and accessed from PL/SQL with DBMS_DBFS_CONTENT
. The file system can be accessed read-only from SQL using the dbfs_content
and dbfs_content_properties
views.
The file system can also be populated and accessed using regular file system APIs and UNIX utilities when mounted using FUSE, or by the standalone dbfs_client
tool (in environments where FUSE
is either unavailable or not set up).
You can use the unmountStore
method to drop SecureFiles Store file systems.
This method removes all stores referring to the file system from the metadata tables, and drops the underlying file system table. The procedure executes like a DDL, auto-committing before and after its execution.
The DBFS SecureFiles Store package (DBMS_DBFS_SFS
) is a store provider for DBMS_DBFS_CONTENT
that supports SecureFiles LOB storage for DBFS content.
To use the DBMS_DBFS_SFS
package, you must be granted the DBFS_ROLE
role.
The SecureFiles Store provider is a default implementation of the DBFS Content API (and is a standard example of a store provider that conforms to the Provider SPI) that enables applications that already use LOBs as columns in their schema, to access the BLOB
columns. This enables existing applications to easily add PL/SQL provider implementations and provide access through the DBFS Content API without changing their schemas or their business logic.
Applications can also read and write content that is stored in other (third party) stores through the standard DBFS Content API interface. See Creating Your Own DBFS Store and Oracle Database PL/SQL Packages and Types Reference for more information about the Provider SPI defined in DBMS_DBFS_CONTENT_SPI
.
In a SecureFiles Store, the underlying user data is stored in SecureFiles LOBs and metadata such as pathnames, IDs, and properties are stored as columns in relational tables. See "SecureFiles LOB Storage" for advanced features of SecureFiles LOBs.
See Oracle Database PL/SQL Packages and Types Reference for more information about the DBMS_DBFS_SFS
package.