TDSQL
TMA-TDSQL-11.6
Ensure the Gateway Unsafe-Function Denylist Is Configured
MediumLevel 2Manual reviewtdsql
Description
The TDSQL Gateway provides an unsafe system function denylist to block the execution of functions that may leak system information or be used for attacks.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
In the OSS management platform (or the Gateway proxy.json) confirm gateway.security.unsafe_sysfunc.openflag = 1 and that gateway.security.unsafe_sysfunc.blacklist lists the dangerous functions your policy requires (e.g. sleep, benchmark, load_file). openflag = 0 or an empty/incomplete denylist is a finding.
How it is fixed
Fix method: Guidance or infrastructure patch
Ensure unsafe function interception is enabled and extend the denylist as needed: { "Name": "gateway.security.unsafe_sysfunc.openflag", "value": "1" }
Properties
- Operating systems
- Any
- Tags
- tdsqlgateway
- Reference
- CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 11.6 Ensure the Gateway Unsafe-Function Denylist Is Configured