TMA-MYSQL-1.1
Place Databases on Non-System Partitions
Description
It is generally accepted that host operating systems should include different filesystem partitions for different purposes. One set of filesystems is typically called system partitions, and these are generally reserved for host system/application operation.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Find the data and log locations: SELECT VARIABLE_NAME, VARIABLE_VALUE FROM performance_schema.global_variables WHERE (VARIABLE_NAME LIKE '%dir' OR VARIABLE_NAME LIKE '%file') AND VARIABLE_NAME NOT LIKE '%core%'; then run df -h <directory> for datadir and the others. They must not be on the root (/), /var or /usr partitions.
How it is fixed
Fix method: Guidance or infrastructure patch
Create a dedicated partition/volume for the data, stop MySQL, move datadir there (copy preserving ownership mysql:mysql), update datadir in /etc/my.cnf (or /etc/mysql/mysql.conf.d/mysqld.cnf) and any SELinux/AppArmor policy, then start MySQL.
Properties
- Operating systems
- Any
- Tags
- mysqldatabasefilesystemmanual
- Reference
- CIS Oracle MySQL Community Server 8.4 Benchmark v1.1.0 - 1.1 Place Databases on Non-System Partitions