| |||||||||
日 | 一 | 二 | 三 | 四 | 五 | 六 | |||
---|---|---|---|---|---|---|---|---|---|
25 | 26 | 27 | 28 | 29 | 30 | 31 | |||
1 | 2 | 3 | 4 | 5 | 6 | 7 | |||
8 | 9 | 10 | 11 | 12 | 13 | 14 | |||
15 | 16 | 17 | 18 | 19 | 20 | 21 | |||
22 | 23 | 24 | 25 | 26 | 27 | 28 | |||
29 | 30 | 1 | 2 | 3 | 4 | 5 |
ResultSet
By default, ResultSets are completely retrieved and stored in memory. In most cases this is the most efficient way to operate, and due to the design of the MySQL network protocol is easier to implement. If you are working with ResultSets that have a large number of rows or large values, and cannot allocate heap space in your JVM for the memory required, you can tell the driver to stream the results back one row at a time.
To enable this functionality, create a Statement
instance in the following manner:
stmt = conn.createStatement(java.sql.ResultSet.TYPE_FORWARD_ONLY, java.sql.ResultSet.CONCUR_READ_ONLY); stmt.setFetchSize(Integer.MIN_VALUE);
The combination of a forward-only, read-only result set, with a fetch size of Integer.MIN_VALUE
serves as a signal to the driver to stream result sets row-by-row. After this, any result sets created with the statement will be retrieved row-by-row.
There are some caveats with this approach. You must read all of the rows in the result set (or close it) before you can issue any other queries on the connection, or an exception will be thrown.
The earliest the locks these statements hold can be released (whether they be MyISAM
table-level locks or row-level locks in some other storage engine such as InnoDB
) is when the statement completes.
If the statement is within scope of a transaction, then locks are released when the transaction completes (which implies that the statement needs to complete first). As with most other databases, statements are not complete until all the results pending on the statement are read or the active result set for the statement is closed.
Therefore, if using streaming results, process them as quickly as possible if you want to maintain concurrent access to the tables referenced by the statement producing the result set.
在 Eclipse 中執行下面代碼。
byte[] bytes = new byte[]{-16, -97, -116, -70};
String s = new String(bytes, "UTF-8");
System.out.println(s);
結果打印出了一朵花,呵呵,實在是太有意思了。
@import url(http://www.aygfsteel.com/CuteSoft_Client/CuteEditor/Load.ashx?type=style&file=SyntaxHighlighter.css);@import url(/css/cuteeditor.css); Picasa 像冊真的很給力,2048 像素以下(包含)的照片不計算空間,據說 15 分鐘以內的也不算空間,除了這些,有1G的空間可以使用。SELinux全稱是Security Enhanced Linux,由美國國家安全部(National Security Agency)領導開發的GPL項目,它擁有一個靈活而強制性的訪問控制結構,旨在提高Linux系統的安全性,提供強健的安全保證,可防御未知攻擊,據稱相當于B1級的軍事安全性能。比MS NT所謂的C2等高得多。
應用SELinux后,可以減輕惡意攻擊或惡意軟件帶來的災難,并提供對機密性和完整性有很高要求的信息很高的安全保障。 SELinux vs Linux 普通Linux安全和傳統Unix系統一樣,基于自主存取控制方法,即DAC,只要符合規定的權限,如規定的所有者和文件屬性等,就可存取資源。在傳統的安全機制下,一些通過setuid/setgid的程序就產生了嚴重安全隱患,甚至一些錯誤的配置就可引發巨大的漏洞,被輕易攻擊。
而SELinux則基于強制存取控制方法,即MAC,透過強制性的安全策略,應用程序或用戶必須同時符合DAC及對應SELinux的MAC才能進行正常操作,否則都將遭到拒絕或失敗,而這些問題將不會影響其他正常運作的程序和應用,并保持它們的安全系統結構。
SELinux的配置相關文件都在/etc/selinux下,其中/etc/selinux/targeted目錄里就包含了策略的詳細配置和context定義,以下是主要文件及功用:
/etc/selinux/targeted/contexts/*_context 默認的context設置
/etc/selinux/targeted/contexts/files/* 精確的context類型劃分
/etc/selinux/targeted/policy/* 策略文件
Apache under SELinux - 讓Apache跑得順起來!
對于剛使用Redhat Enterprise Linux 4 或Fedora Core 2以上/CentOS 4的用戶,一定會為Apache經常無法正常運轉,報以"Permission denied"等錯誤而大為不解,甚至大為惱火。
其實這是因為這些系統里激活了SELinux,而用戶的apache配置與SELinux的配置策略有抵觸產生的,只有通過適當調整,使apache的配置和訪問符合策略才能正常使用。
現在下面來分析一下SELinux中有關httpd(apache)的context定義(略有刪節)
/home/[^/]+/((www)|(web)|(public_html))(/.+)? system_u:object_r:httpd_user_content_t
/var/www(/.*)? system_u:object_r:httpd_sys_content_t
/var/www/cgi-bin(/.*)? system_u:object_r:httpd_sys_script_exec_t
/usr/lib/cgi-bin(/.*)? system_u:object_r:httpd_sys_script_exec_t
/var/www/perl(/.*)? system_u:object_r:httpd_sys_script_exec_t
/var/www/icons(/.*)? system_u:object_r:httpd_sys_content_t
/var/cache/httpd(/.*)? system_u:object_r:httpd_cache_t
/etc/vhosts -- system_u:object_r:httpd_config_t
/usr/sbin/httpd -- system_u:object_r:httpd_exec_t
/usr/sbin/apache(2)? -- system_u:object_r:httpd_exec_t
/usr/sbin/suexec -- system_u:object_r:httpd_suexec_exec_t
/var/log/httpd(/.*)? system_u:object_r:httpd_log_t
/var/log/apache(2)?(/.*)? system_u:object_r:httpd_log_t
/var/log/cgiwrap\.log.* -- system_u:object_r:httpd_log_t
/var/cache/ssl.*\.sem -- system_u:object_r:httpd_cache_t
/var/cache/mod_ssl(/.*)? system_u:object_r:httpd_cache_t
/var/run/apache(2)?\.pid.* -- system_u:object_r:httpd_var_run_t
/var/lib/httpd(/.*)? system_u:object_r:httpd_var_lib_t
/var/lib/php/session(/.*)? system_u:object_r:httpd_var_run_t
/etc/apache-ssl(2)?(/.*)? system_u:object_r:httpd_config_t
/usr/lib/apache-ssl(/.*)? -- system_u:object_r:httpd_exec_t
/usr/sbin/apache-ssl(2)? -- system_u:object_r:httpd_exec_t
/var/log/apache-ssl(2)?(/.*)? system_u:object_r:httpd_log_t
/var/run/apache-ssl(2)?\.pid.* -- system_u:object_r:httpd_var_run_t
/var/run/gcache_port -s system_u:object_r:httpd_var_run_t
/var/lib/squirrelmail/prefs(/.*)? system_u:object_r:httpd_squirrelmail_t
/usr/bin/htsslpass -- system_u:object_r:httpd_helper_exec_t
/usr/share/htdig(/.*)? system_u:object_r:httpd_sys_content_t
/var/lib/htdig(/.*)? system_u:object_r:httpd_sys_content_t
針對上述的內容,可以對如下的幾個常見問題進行簡單處理:
1.phpmyadmin在非默認/var/www/html目錄下無法運轉
通常類似的情況都是在配置了虛擬主機時,訪問/phpmyadmin等提示403訪問拒絕,日志里也提示Permission denied,這是因為phpmyadmin防止的目錄及文件本身屬性不符合context要求。
假設phpmyadmin放在/web目錄下,那么執行:
chcon -R -t httpd_user_content_t /web
則會令/web及其下所有子目錄/文件,包括phpmyadmin文件都獲得了httpd_user_content_t的屬性,如果其傳統的Unix屬性對httpd來說是可讀的話,再重新訪問一下就應該可以了。
2./home目錄下的虛擬主機無法運轉
與問題1也是類似的,不過根據上文中context的定義,/home目錄下必須是用戶的$HOME/www或public_html或web目錄才是 httpd_user_content_t類型,因此建議將要作為web頁面的內容放置在用戶的$HOME/www或web或public_html里,并確保其屬性是httpd_user_content_t,使用如下命令查看:
ls -Z /home/abc/
drwxr-xr-x abc abc user_u:object_r:user_home_dir_t tmp
drwxrwxr-x abc abc user_u:object_r:httpd_user_content www
如不是,則可通過chcon來逐級目錄及文件更改,直至最后能訪問:
chcon -R -t httpd_user_content_t /home/abc/web
chcon -t user_home_dir_t /home/abc
3.CGI程序無法運行
如果cgi程序放在/var/www/cgi-bin/里也無法執行,遇到403或500錯誤的話,可以檢查cgi程序的屬性,按SELinux contexts文件里定義的,/var/www/cgi-bin/里必須是httpd_sys_script_exec_t 屬性。通過ls -Z查看,如果不是則通過如下命令更改:
chcon -t httpd_sys_script_exec_t /var/www/cgi-bin/*.cgi
如果是虛擬主機里的cgi,則參考問題2使之能正常使用普通的功能后,再通過chcon設置cgi文件的context為httpd_sys_script_exec_t即可。
4.Setuid/gid 程序無法運行
例如早期的SqWebMail及qmailadmin等,需要setuid/gid的支持,但在SELinux下這將受到嚴格限制。第一種方法是比較徹底的辦法,能保留系統的安全性,通過:
audit2allow -l -i /var/log/messages
將SELinux拒絕的信息轉換為相應的policy allow指令,將這些指令添加到SELinux policy 的src里相應的配置文件,重新生成policy并加載。但這樣做相對比較麻煩。
另一個方法最簡單,但將使apache得不到保護。首先確定SELinux 類型是targeted的:
cat /etc/selinux/config|grep SELINUXTYPE
然后,使apache脫離SELinux保護:
setsebool -P httpd_disable_trans 1
然后重啟動apache:
/etc/init.d/httpd restart
這樣所有apache強制的檢查都失效,需要setuid/gid的程序可以正常使用。但這樣帶來了增加漏洞的危險,對于迫切需要運行而又很急的情況,本方法是一個最大限度減少系統安全缺失的最后辦法。對于取消SELinux 未必是一個好方法。
一.
ps -Z
ls -Z
id -Z
例:
[root@ljj cgi-bin]# ls -Z
-rwxrwxrwx root root root:object_r:httpd_sys_script_exec_t a.cgi
-rw-r--r-- root root root:object_r:httpd_sys_script_exec_t a.txt
二. chcon
修改文件的屬性 fild1:fild2:fild3
chcon -u fild1 file
chcon -l fild2 file
chcon -t fild3 file
例:
chcon -u root file1
三.getsebool
獲取se相關的bool值
例:
[root@ljj cgi-bin]# getsebool -a | grep httpd
httpd_builtin_scripting --> inactive
httpd_disable_trans --> active
httpd_enable_cgi --> active
httpd_enable_homedirs --> active
httpd_ssi_exec --> active
httpd_tty_comm --> inactive
httpd_unified --> inactive
得到了一些與httpd相關的bool值,配置httpd.conf中的user_dir時,要保證這里的httpd_enable_homedirs是 active的,還要保證:
chcon -R -t httpd_sys_content_t ~user/public_html;
四. togglesebool
給se的相關bool值取反
例:
togglesebool httpd_enable_homedirs
本次操作環境:
Ubuntu Server 10.10
SCSI Harddisk:/dev/sda 500GB
U盤:/dev/sdb 8GB(模擬成USB Harddisk,安裝OS)
介紹2種分區表:
MBR分區表:(MBR含義:主引導記錄)
所支持的最大卷:2T (T; terabytes,1TB=1024GB)
對分區的設限:最多4個主分區或3個主分區加一個擴展分區。
GPT分區表:(GPT含義:GUID分區表)
支持最大卷:18EB,(E:exabytes,1EB=1024TB)
每個磁盤最多支持128個分區
所以如果要大于2TB的卷或分區就必須得用GPT分區表。
Linux下fdisk工具不支持GPT,得使用另一個GNU發布的強大分區工具parted。
fdisk工具用的話,會有下面的警告信息:
WARNING: GPT (GUID Partition Table) detected on '/dev/sda'! The util fdisk doesn't support GPT. Use GNU Parted.
下面是用parted工具對/dev/sda做GPT分區的過程:
root@node01:/mnt# parted /dev/sda
GNU Parted 2.3
Using /dev/sda
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) mklabel gpt
Warning: The existing disk label on /dev/sda will be destroyed and all data on this disk
will be lost. Do you want to continue?
Yes/No? yes
(parted) print
Model: DELL PERC 6/i Adapter (scsi)
Disk /dev/sda: 500GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Number Start End Size File system Name Flags
(parted)mkpart primary 0KB 500GB
Warning: You requested a partition from 0.00B to 500GB.
The closest location we can manage is 17.4kB to 500GB.
Is this still acceptable to you?
Yes/No? yes
Warning: The resulting partition is not properly aligned for best performance.
Ignore/Cancel? Ignore
(parted) print
Model: DELL PERC 6/i Adapter (scsi)
Disk /dev/sda: 500GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Number Start End Size File system Name Flags
1 17.4kB 500GB 500GB primary
(parted)quit
Information: You may need to update /etc/fstab.
root@node01:/#fdisk -l
WARNING: GPT (GUID Partition Table) detected on '/dev/sda'! The util fdisk doesn't support GPT. Use GNU Parted.
Disk /dev/sda: 499.6 GB, 499558383616 bytes
255 heads, 63 sectors/track, 60734 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000
Device Boot Start End Blocks Id System
/dev/sda1 1 60735 487849983+ ee GPT
root@node01:/#mkfs.ext4 /dev/sda1
mke2fs 1.41.12 (17-May-2010)
文件系統標簽=
操作系統:Linux
塊大小=4096 (log=2)
分塊大小=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
30490624 inodes, 121962487 blocks
6098124 blocks (5.00%) reserved for the super user
第一個數據塊=0
Maximum filesystem blocks=4294967296
3722 block groups
32768 blocks per group, 32768 fragments per group
8192 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968,
102400000
正在寫入inode表: 完成
Creating journal (32768 blocks): 完成
Writing superblocks and filesystem accounting information: 完成
This filesystem will be automatically checked every 24 mounts or
180 days, whichever comes first. Use tune2fs -c or -i to override.
root@node01:/#mount /dev/sda1 /export/glusterfs01/
root@node01:/# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/node01-root
6.8G 987M 5.5G 16% /
none 7.9G 208K 7.9G 1% /dev
none 7.9G 0 7.9G 0% /dev/shm
none 7.9G 32K 7.9G 1% /var/run
none 7.9G 0 7.9G 0% /var/lock
/dev/sdb1 228M 21M 196M 10% /boot
/dev/sda1 458G 198M 435G 1% /export/glusterfs01
root@node01:/#vi /etc/fstab
# /etc/fstab: static file system information.
#
# Use 'blkid -o value -s UUID' to print the universally unique identifier
# for a device; this may be used with UUID= as a more robust way to name
# devices that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point> <type> <options> <dump> <pass>
proc /proc proc nodev,noexec,nosuid 0 0
/dev/mapper/node01-root / ext4 errors=remount-ro 0 1
# /boot was on /dev/sdb1 during installation
UUID=c21707ff-ba0f-43ee-819a-8e72fa0f8500 /boot ext2 defaults 0 2
/dev/mapper/node01-swap_1 none swap sw 0 0
/dev/sda1 /export/glusterfs01 ext4 defaults 0 2
重啟就可以自動掛載了!至此完成。
@import url(http://www.aygfsteel.com/CuteSoft_Client/CuteEditor/Load.ashx?type=style&file=SyntaxHighlighter.css);@import url(/css/cuteeditor.css);