← Back to MariaDB Enterprise Server Security Technical Implementation Guide

V-286185

CAT II (Medium)

The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the MariaDB, etc.) must be restricted to authorized users.

Rule ID

SV-286185r1292234_rule

STIG

MariaDB Enterprise Server Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001499

Discussion

If the MariaDB were to allow any user to make changes to database structure or logic, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.

Check Content

As the DBA (root), list all roles and their permissions. 

Run this database query to create the "SHOW GRANTS" script for each role: 

SELECT DISTINCT CONCAT( 'SHOW GRANTS FOR ', user,'@', host,';') AS grantQuery FROM mysql.user WHERE is_role = 'Y';

Example output:
+----------------------------------------+
| grantQuery                             |
+----------------------------------------+
| SHOW GRANTS FOR admin@; |
| SHOW GRANTS FOR app_writer@;        |

Run each "SHOW GRANTS" command for each role.

SELECT * FROM information_schema.APPLICABLE_ROLES;

Verify that all roles have the correct privileges. If they do not, this is a finding.

Fix Text

As the DBA, revoke any permissions from a role that are deemed unnecessary by running the following SQL:

REVOKE privilege_type ON database_name.table_name FROM 'username'@'host';

Revoke any roles from a user if they are deemed unnecessary by running the following SQL:

REVOKE  ROLE_NAME  FROM  test_user ;

If the revoked role is the default role for the user, the "REVOKE" command should be followed by a command to set a new default role that has appropriate permissions, or no default role:

SET DEFAULT ROLE NONE FOR  test_user ;
SET DEFAULT ROLE  ROLE_NAME  for  test_user ;