{ "date": "2016-11-16T09:32:35", "slug": "12cr2-create_file_dest-for-pdb-isolation", "link": "https://www.dbi-services.com/blog/12cr2-create_file_dest-for-pdb-isolation/", "title": { "rendered": "12cR2: CREATE_FILE_DEST for PDB isolation" }, "content": { "rendered": "

By Franck Pachot

\n

.
\nTwo years ago I filled an OTN idea to ‘Constrain PDB datafiles into specific directory’ and made it an enhancement request for 12c Release 2. When you provision a PDB, the PDB admin can create tablespaces and put datafiles anywhere in your system. Of course this is not acceptable in a cloud environment. 12.1 has a parameter for directories (PATH_PREFIX) and 12.2 brings CREATE_FILE_DEST for datafiles.
\n

\n

create_file_dest

\n

Here is the new option when you create a pluggable database:

\n
\nSQL>  create pluggable database PDB1 admin user admin identified by password role=(DBA)\n      create_file_dest='/u02/app/oracle/oradata/CDB2/PDB1';\n \nPluggable database created.\n
\n

Let’s see where are my datafiles:

\n
\nSQL> alter pluggable database PDB1 open;\nPluggable database altered.\nSQL> alter session set container=PDB1;\nSession altered.\nSQL> select name from v$datafile;\n \nNAME\n--------------------------------------------------------------------------------\n/u02/app/oracle/oradata/CDB2/PDB1/CDB2/415260E5D27B5D4BE0534E186A0A4CB8/datafile/o1_mf_system_d2od2o7b_.dbf\n/u02/app/oracle/oradata/CDB2/PDB1/CDB2/415260E5D27B5D4BE0534E186A0A4CB8/datafile/o1_mf_sysaux_d2od2o7j_.dbf\n/u02/app/oracle/oradata/CDB2/PDB1/CDB2/415260E5D27B5D4BE0534E186A0A4CB8/datafile/o1_mf_undotbs1_d2od2o7l_.dbf\n
\n

My files have been created in the CREATE_FILE_DEST directory specified at PDB creation, and with an OMF structure.
\nSo maybe I don’t want to include the CDB name and the PDB name but only a mount point.

\n

If, as a local user, I try to create a datafile elsewhere I get an error:

\n
\nSQL> connect admin/password@//localhost/pdb1.opcoct.oraclecloud.internal\nConnected.\nSQL> create tablespace APPDATA datafile '/tmp/appdata.dbf' size 5M;\ncreate tablespace APPDATA datafile '/tmp/appdata.dbf' size 5M\n*\nERROR at line 1:\nORA-65250: invalid path specified for file - /tmp/appdata.dbf\n
\n

This is exactly what I wanted.

\n

Because I’m bound to this directory, I don’t need to give an absolute path:

\n
\nSQL> create tablespace APPDATA datafile 'appdata.dbf' size 5M;\n \nTablespace created.\n \nSQL> select name from v$datafile;\n \nNAME\n-------------------------------------------------------------------------------------------------------------\n/u02/app/oracle/oradata/CDB2/PDB1/CDB2/415260E5D27B5D4BE0534E186A0A4CB8/datafile/o1_mf_system_d2od2o7b_.dbf\n/u02/app/oracle/oradata/CDB2/PDB1/CDB2/415260E5D27B5D4BE0534E186A0A4CB8/datafile/o1_mf_sysaux_d2od2o7j_.dbf\n/u02/app/oracle/oradata/CDB2/PDB1/CDB2/415260E5D27B5D4BE0534E186A0A4CB8/datafile/o1_mf_undotbs1_d2od2o7l_.dbf\n/u02/app/oracle/oradata/CDB2/PDB1/appdata.dbf\n
\n

So you don’t need to use OMF there. If the PDB administrator wants to name the datafiles, he can, as long as they stays under the create_file_dest directory. You can create a datafile in a sub-directory of create_file_dest but it needs to exist of course.

\n

db_create_file_dest

\n

Here it just looks like OMF, so I check the db_create_file_dest parameter:

\n
\nSQL> show parameter file_dest\n \nNAME                                 TYPE        VALUE\n------------------------------------ ----------- ---------------------------------\ndb_create_file_dest                  string      /u02/app/oracle/oradata/CDB2/PDB1\n
\n

and I try to change it (as local user):

\n
\nSQL> connect admin/password@//localhost/pdb1.opcoct.oraclecloud.internal;\nConnected.\nSQL> alter system set db_create_file_dest='/tmp';\nalter system set db_create_file_dest='/tmp'\n*\nERROR at line 1:\nORA-32017: failure in updating SPFILE\nORA-01031: insufficient privileges\n \nSQL> alter session set db_create_file_dest='/tmp';\nERROR:\nORA-02097: parameter cannot be modified because specified value is invalid\nORA-01031: insufficient privileges\n
\n

No need to use lockdown profile here, it is verified at runtime that a local user cannot change it.

\n

If you are connected with a common user, here connected as sysdba, this is the way to change what has been specified at PDB creation time:

\n
\nSQL> show con_id\n \nCON_ID\n------------------------------\n3\n \nSQL> alter system set db_create_file_dest='/tmp';\nSystem altered.\n \nSQL> create tablespace APP1;\nTablespace created.\n \nSQL> select name from v$datafile;\n \nNAME\n--------------------------------------------------------------------------------\n/u02/app/oracle/oradata/CDB2/PDB1/CDB2/415260E5D27B5D4BE0534E186A0A4CB8/datafile/o1_mf_system_d2od2o7b_.dbf\n/u02/app/oracle/oradata/CDB2/PDB1/CDB2/415260E5D27B5D4BE0534E186A0A4CB8/datafile/o1_mf_sysaux_d2od2o7j_.dbf\n/u02/app/oracle/oradata/CDB2/PDB1/CDB2/415260E5D27B5D4BE0534E186A0A4CB8/datafile/o1_mf_undotbs1_d2od2o7l_.dbf\n/u02/app/oracle/oradata/CDB2/PDB1/appdata.dbf\n/tmp/CDB2/415260E5D27B5D4BE0534E186A0A4CB8/datafile/o1_mf_app1_d2ohx5sp_.dbf\n
\n

But…

\n

The behavior when you create the PDB with the CREATE_FILE_DEST clause is different than when you create it without, and set db_create_file_dest later. In the second case, the restriction does not occur and a local DBA can create a datafile wherever he wants.

\n

So I wanted to check whether this attribute is shipped when plugging PDBs. When looking at the pdb_descr_file xml file I don’t see anything different except the parameter:

\n
\n   <parameters>\n      <parameter>processes=300\n      <parameter>nls_language='AMERICAN'\n      <parameter>nls_territory='AMERICA'\n      <parameter>filesystemio_options='setall'\n      <parameter>db_block_size=8192\n      <parameter>encrypt_new_tablespaces='CLOUD_ONLY'\n      <parameter>compatible='12.2.0'\n      <parameter>db_files=250\n      <parameter>open_cursors=300\n      <parameter>sql92_security=TRUE\n      <parameter>pga_aggregate_target=1775294400\n      <parameter>sec_protocol_error_trace_action='LOG'\n      <parameter>enable_pluggable_database=TRUE\n      <spfile>*.db_create_file_dest='/u02/app/oracle/oradata/CDB2/PDB1'\n    </parameters>\n
\n

So I tried to unplug/plug my PDB and the restriction is gone. So be careful.

\n

I’ve not find a documented way to check if restriction is enabled or not (except trying to create a file outside of db_create_file_dest). Please comment if you know.
\nHowever, it seems that that a flag in CONTAINER$ is unset when restriction is there:

\n
\nSQL> create pluggable database PDB1 admin user admin identified by password role=(DBA) create_file_dest='/u02/app/oracle/oradata/CDB2/PDB1';\nPluggable database created.\n \nSQL> select con_id#,flags,decode(bitand(flags, 2147483648), 2147483648, 'YES', 'NO') from container$;\n \n   CON_ID#      FLAGS DEC\n---------- ---------- ---\n         1          0 NO\n         2 3221487616 YES\n         3 1610874880 NO\n
\n

Creating the same PDB but without the create_file_dest clause has the same flag as ‘NO’

\n
\ncreate pluggable database PDB1 admin user admin identified by password role=(DBA);\nPluggable database created.\n \nSQL> select con_id#,flags,decode(bitand(flags, 2147483648), 2147483648, 'YES', 'NO') from container$;\n \n   CON_ID#      FLAGS DEC\n---------- ---------- ---\n         1          0 NO\n         2 3221487616 YES\n         3 1074003968 NO\n
\n

I suppose that it is stored elsewhere because those flags are set only once PDB is opened.

\n", "protected": false } }