Ensure excessive DML privileges are revoked

MittelStufe 1Manuelle Prüfungyugabytedb

Beschreibung

DML (insert, update, delete) operations at the table level should be restricted to only authorized users. YugabyteDB manages table-level DML permissions via the GRANT statement.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

In each database list users (\du+ *) and tables (\dt *.*) and review table grants (\dp or information_schema.role_table_grants). Any user holding INSERT, UPDATE, DELETE or TRUNCATE on tables it does not need for its role is a finding; revoke with REVOKE <priv> ON <table> FROM <user>.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

If a given database user has been granted excessive DML privileges for a given database table, those privileges should be revoked immediately using the REVOKE YSQL command. Continuing with the example above, remove unauthorized grants for appreader user using the REVOKE statement and verify the Boolean values are now false. yugabyte=# REVOKE INSERT, UPDATE, DELETE ON TABLE customer FROM appreader;

Eigenschaften

Betriebssysteme: Beliebig
Tags: yugabytedbprivileges
Referenz: CIS YugabyteDB Benchmark v2.0.0 - 4.4 Ensure excessive DML privileges are revoked