Rule ID
SV-286218r1291948_rule
Version
V1R1
Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications. Satisfies: SRG-APP-000380-DB-000360, SRG-APP-000378-DB-000365
If MariaDB supports only software development, experimentation, and/or developer-level testing (excluding production systems, integration testing, stress testing, and user acceptance testing), this is not a finding. Review MariaDB and database security settings with respect to nonadministrative users' ability to create, alter, or replace logic modules, to include stored procedures, functions, triggers, and views. 1. List the privileges for all users on all tables and schemas, as the DBA (shown here as root). Loop over all the MariaDB users and "SHOW GRANTS" for each using the command below. "SHOW GRANTS" list the privileges granted to the account. Run the following to create the "SHOW GRANTS" script for each user: SELECT DISTINCT CONCAT( 'SHOW GRANTS FOR ', user,'@', host,';') AS grantQuery FROM mysql.user WHERE is_role = 'N'; Example output: +----------------------------------------+ | grantQuery | +----------------------------------------+ | SHOW GRANTS FOR mariadb.sys@localhost; | | SHOW GRANTS FOR root@localhost; | Run each "SHOW GRANTS" command for each user. 2. Only "DEFINERS" of routines (functions and procedures) can change routines. To view the "DEFINERS" of all functions and procedures, run: SELECT * from mysql.proc \G; 3. Only "DEFINERS" of triggers can change triggers. To view all triggers and their "DEFINERS:" run: SELECT * from information_schema.triggers \G; 4. Views: At view definition time, the view creator must have the privileges needed to use the top-level objects accessed by the view. For example, if the view definition refers to table columns, the creator must have privileges for the columns. If the definition refers to a stored function, only the privileges needed to invoke the function can be checked. The privileges required when the function runs can be checked only as it executes. For different invocations of the function, different execution paths within the function can be taken. If any such permissions exist and are not documented and approved, this is a finding. If any database or schema has update or create privileges and should not, this is a finding.
Document and obtain approval for any nonadministrative users who require the ability to create, alter or replace logic modules. Check the security guide to implement the approved permissions. Revoke any unapproved permissions. Configure MariaDB to enforce access restrictions associated with changes to the configuration of MariaDB or database(s). 1. Use "REVOKE" to revoke privileges or roles on objects from users: REVOKE privileges ON object FROM user ; 2. Use "REVOKE" to remove a role from a user or another role that it has previously been assigned to: REVOKE role FROM grantee or role ;