Rule ID
SV-286205r1292195_rule
Version
V1R1
CCIs
Applications, including MariaDB, must prevent unauthorized and unintended information transfer via shared system resources. Permitting only MariaDB processes and authorized, administrative users to have access to the files where the database resides helps ensure that those files are not shared inappropriately and are not open to backdoor access and manipulation.
By default, all the MariaDB database files, log files, and backup files are located in the "/var/lib/mysql". To find the location of the datadir, run the command: SHOW GLOBAL VARIABLES LIKE 'datadir'; Check the "/etc/my.cnf" file for the following variables to determine if any of these files have a nondefault location configured. Only variables that specify a directory different from datadir will be in a different directory. If the variable only specifies a file name, that file will still be in the default directory. error_log innodb_log_group_home_dir innodb_temp_data_file_path innodb_tmpdir innodb_undo_directory log_bin_basename log_error relay_log_basename relay_log_file_info sql_error_log_filename tmpdir Verify file system permissions for database files, database log files, and database backup files to ensure they are properly restricted. To verify file ownership and permissions, run the following commands as the DBA (root): sudo su - root ls -lR $DATADIR If any configuration variables specify directories outside of "$DATADIR", review those directories: ls -lR <directory_path> If backup tools such as "mysqldump" or other backup utilities are used, review the directory where backup files are stored and verify permissions using the same command. Database files, log files, and backup files must be owned by the DBA account and must not permit unauthorized users to read, write, or execute these files. If any files are not owned by the DBA, or if file permissions allow access by unauthorized users, this is a finding. If any user, role, or account other than an authorized system administrator (SA), authorized DBA, or required system service account is permitted to read or view database files, log files, or backup files, this is a finding.
By default, all of the MariaDB database files, log files, and backup files are located in the "/var/lib/mysql". Review the "/etc/my.cnf" configuration file to determine whether any files are configured to use a nondefault directory. Only variables that explicitly define a directory different from "$DATADIR" will place files outside the default data directory. If the variable specifies only a file name, the file remains within "$DATADIR". Check the following configuration variables: error_log innodb_log_group_home_dir innodb_temp_data_file_path innodb_tmpdir innodb_undo_directory log_bin_basename log_error relay_log_basename relay_log_file_info sql_error_log_filename tmpdir Verify that the operating system permissions on database files, database log files, and database backup files restrict access so that only required system accounts, authorized system administrators, and DBAs with a legitimate need can read or modify them. Any files created within "$DATADIR", or within any alternate directory defined by the variables above, must be owned by the database owner account (typically mysql) and should have permissions limited to the owner for read, write, and execute access.