23.2.2 Security Characteristics of the Configuration

The configuration we've established here accomplishes two important security objectives:

• It allows the system administrator to run the external procedure listener as a user account with limited privileges. By default, the listener would run as the account that runs the Oracle server.

• It limits the external procedure listener to accept only IPC connections from the local machine, as opposed to TCP/IP connections from anywhere.

But we're not quite done. The tnsnames.ora file for the database in which the callout originates will need an entry like the following:

EXTPROC_CONNECTION_DATA =

(DESCRIPTION =

(ADDRESS = (PROTOCOL = IPC)(KEY = extprocKey))

(CONNECT_DATA = (SID = extprocSID) (PRESENTATION = RO))

)

You'll recognize most of these settings from the earlier listener configuration. Note that the values you used in the listener for extprocKey and extprocSID must match their respective values here. The optional PRESENTATION setting is intended to improve performance a bit; it tells the server, which might be listening for different protocols, to assume that the client wants to communicate using the protocol known as "RemoteOps" (hence the RO).

You'll want to be careful about what privileges the supplemental listener account has, especially regarding its rights to modify files owned by the operating system or by the oracle account. Also, by setting the TNS_ADMIN environment variable on Unix (or in the registry of a Microsoft operating system), you can relocate the external procedure listener's listener.ora and sqlnet.ora files to a separate directory. This may be another aspect of an overall approach to security.

Setting up these configuration files and creating supplemental OS-level user accounts may seem rather distant from day-to-day PL/SQL programming, but these days, security is everybody's business!

Oracle professionals should keep up with Oracle's security alerts page at http://otn.oracle.com/deploy/security/alerts.htm. The external procedures problem I mentioned back in Section 23.2.1 appears as alert number 29, but every Oracle shop should review the entire list of issues to discover what workarounds or patches to employ.

23.3 Creating an Oracle Library

The SQL statement CREATE LIBRARY defines an alias in the Oracle data dictionary for the external shared library file, allowing the PL/SQL runtime engine to find the library when it is called. The only users who can create libraries are administrators and those to whom they have granted the CREATE LIBRARY or CREATE ANY LIBRARY privilege.

The general syntax for the CREATE LIBRARY command is:

CREATE [ OR REPLACE ] LIBRARY library_name

AS

'path_to_file' [ AGENT 'agent_db_link' ] ;

where:

library_name

A legal PL/SQL identifier. This name will be used in subsequent bodies of external procedures that need to call the shared object (or DLL) file. The library name cannot be the same as a table, top-level PL/SQL object, or anything else in the main namespace.

path_to_file

The fully qualified pathname to the shared object (or DLL) file, enclosed in single quotes.

In Oracle9i, it became possible to use environment variables in path_to_file. In particular, if the operating system-level account sets the variable before starting the listener, you can put this variable in the CREATE LIBRARY statement; for example:

CREATE LIBRARY extprocshell_lib AS '${ORACLE_HOME}/lib/extprocsh.so'; -- Unix

CREATE LIBRARY extprocshell_lib AS '%ORACLE_HOME%\bin\extprocsh.dll'; -- MS

This may be a good thing to do for the sake of script portability, although it is unclear to me whether using an environment variable in this fashion is good from a security standpoint.

Another way to make variables available to libraries is to add the variable to the ENVS setting of the external procedure listener. To make a MYLIBS variable available on Unix, you could use:

(ENVS="EXTPROC_DLLS=ANY,MYLIBS=/usr/local/extproclib")

Note that a comma separates the DLL path and the environment variable setting. You would therefore create a library using a statement such as:

CREATE LIBRARY extprocshell_lib AS '${MYLIBS}/extprocsh.so'; -- Unix

I have confirmed that putting the variable in ENVS and referring to it in the library path does in fact work on Unix systems, but my attempts to use the equivalent on Microsoft Windows XP did not succeed.

One final comment: another variable on Unix systems that you may want to set is LD_LIBRARY_PATH or its equivalent, in order to supply the external procedure a non-default search path for shared libraries it needs to open.

AGENT 'agent_db_link'

Optional database link (Oracle9i and later) to which the library owner has access; the link must be associated with a service name for an external procedure. Using the AGENT clause allows the external procedure to run on a different database server, although it must still be on the same machine.

Here are some things to keep in mind when issuing a CREATE LIBRARY statement:

• The statement must be executed by the DBA or by a user who has been granted CREATE LIBRARY or CREATE ANY LIBRARY privileges.

• As with most other database objects, libraries are owned by a specific Oracle user (schema). The owner automatically has execution privileges, and can grant and revoke the EXECUTE privilege on the library to other users.

• Other users who have received EXECUTE privilege on a library can refer to it in their own call specs using owner.library syntax, or they can create and use synonyms for the library if desired.

• Oracle doesn't check whether the named shared library file exists when you execute the CREATE LIBRARY statement. Nor will it check when you later create an external procedure declaration for a function in that library. If you have an error in the path, you won't know it until the first time you try to execute the function.

You need to create only a single Oracle library in this fashion for each shared library file you use. There can be any number of callable C functions in the library file, and any number of call specifications that refer to the library.

Let's take a closer look at how to write a PL/SQL subprogram that maps the desired routine from the shared library into a PL/SQL-callable form.