TMA-TDSQL-3.14
Ensure Correct Permissions on the Temporary File Directory
Description
The MySQL tmpdir may contain temporary tables, intermediate query results, and sort files. Its effective location must be placed on a controlled filesystem and be accessible only to the operating-system account that runs the database. Runs the mysql client against the TDSQL data node selected by TDSQL_MYSQL_OPTS (e.g. "-h10.0.0.5 -P4001 -utdsql_audit"); keep the password in ~/.my.cnf or a login path rather than MYSQL_PWD or the command line (see 1.4 and 1.5). Reads the effective tmpdir from the instance and requires each directory to be owned by a non-root (service) account and not writable by group or other (0700, or 0750 with an approved group). Run on the data-node host; also confirm with findmnt -T that it is on an approved filesystem.
How it is checked
Audit method: SQL query
t=$(mysql ${TDSQL_MYSQL_OPTS:-} -NBe "SELECT @@global.tmpdir" 2>/dev/null) || exit 1; bad=0; seen=0; IFS=':'; for d in $t; do seen=1; s=$(stat -Lc '%a %U' "$d" 2>/dev/null) || { bad=1; continue; }; p=${s% *}; o=${s#* }; [ $((0$p & 022)) -eq 0 ] || bad=1; [ "$o" != root ] || bad=1; done; [ $seen -eq 1 ] && [ $bad -eq 0 ] && echo compliant || echo noncompliant- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
install -d -m 0700 -o tdsql -g tdsql /data/tdsql_tmp, set tmpdir to it through the TDSQL custom parameter template and restart the instance.
Properties
- Operating systems
- Any
- Tags
- tdsqlpermissions
- Reference
- CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 3.14 Ensure Correct Permissions on the Temporary File Directory
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target tdsql