TMA-MYSQL-4.6

Ensure Symbolic Links are Disabled

MediumLevel 1Automatedmysql

Description

The symbolic-links and skip-symbolic-links options for MySQL determine whether symbolic link support is available. When use of symbolic links is enabled, they have different effects depending on the host platform. When symbolic links are disabled, then symbolic links stored in files or entries in tables are not used by the database. Runs mysql -NBe with the client defaults: put an administrative account in ~/.my.cnf (mode 0600) or a mysql_config_editor login path, not MYSQL_PWD (see 1.4/1.6).

How it is checked

Audit method: SQL query

sql_query

out=$(mysql -NBe "SELECT IF(@@global.have_symlink = 'DISABLED', 'compliant', 'noncompliant')" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Set skip-symbolic-links=YES under [mysqld] in /etc/my.cnf (or /etc/mysql/mysql.conf.d/mysqld.cnf), then restart MySQL.

Properties

Operating systems: Any
Tags: mysqldatabaseconfiguration
Reference: CIS Oracle MySQL Community Server 8.4 Benchmark v1.1.0 - 4.6 Ensure Symbolic Links are Disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target mysql