Ensure MySQL is Run Under a Sandbox Environment

低级别 2人工审核mysql

说明

Use of the chroot() system call at startup, Systemd with settings to achieve isolation, or docker will put MySQL in a Sandbox environment.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Check whether MySQL is confined: chroot option (grep -r '^chroot' /etc/mysql /etc/my.cnf*; must differ from datadir), systemd unit runs as a non-root user (systemctl status mysqld: Main PID not owned by root), or it runs in a container (docker ps / podman ps). None of these is a fail.

修复方式

修复方法: 操作指南或基础设施补丁

Run MySQL under systemd as the mysql user, in a container, or with chroot=<path> under [mysqld], and keep SELinux/AppArmor confinement enabled.

属性

操作系统: 任意
标签: mysqldatabaseosisolationmanual
参考: CIS Oracle MySQL Community Server 8.4 Benchmark v1.1.0 - 1.7 Ensure MySQL is Run Under a Sandbox Environment