TDSQL
TMA-TDSQL-5.7
Ensure No Excessive `PROCESS` Privilege Grants
MediumLevel 2Manual reviewtdsql
Description
The PROCESS privilege allows users to view the current queries of all threads and users (SHOW PROCESSLIST), potentially exposing sensitive data contained in other users' SQL statements.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
SELECT User, Host FROM mysql.user WHERE Process_priv = 'Y' AND User NOT LIKE 'tdsqlsys%'; Confirm only system accounts and approved administrators hold this privilege.
How it is fixed
Fix method: Guidance or infrastructure patch
REVOKE PROCESS ON *.* FROM 'username'@'host';
Properties
- Operating systems
- Any
- Tags
- tdsqlprivileges
- Reference
- CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 5.7 Ensure No Excessive `PROCESS` Privilege Grants