WL#5608: Assert that all distributed files follow the principle of most restrictive permission possible
Affects: Server-5.7
—
Status: Complete
Executive Summary ----------------- Files generated by the application should be given the most restrictive file permissions possible. Please perform a review of the file permissions on different platforms, focusing particularly on password files, audit or log files and configuration files. This review might need to have a short-term and a medium term aspect. In the short term tighten up permission as much as possible without breaking anything. In the medium term look to change scripts and code that depend on permissive file permissions, to allow further tightening of permissions. What We Have ------------ Running mysql_install_db generates number of files under data directory. These files include: Directories for various databases Files corresponding to various tables in each database Log files Configuration file Apart from this, installation also generates default configuration file (my.cnf) and some other files (e.g. audit log if audit plugin is used).
User/Group Permission F1 : data directory should have drwxr-x--- permission with respect to mysql/mysql.
I1 : Change default directory permission from 0700 to 0770. This will allow default "mysql" group to access data directory and its sub directory. I2 : Change mysql_install_db to create data directory with permission drwxrwx--- with respect to effective user and its primary group(--user parameter).
Copyright (c) 2000, 2024, Oracle Corporation and/or its affiliates. All rights reserved.