TDSQL
TMA-TDSQL-5.6
Ensure No Excessive `FILE` Privilege Grants
高级别 1人工审核tdsql
说明
The FILE privilege allows users to read and write server filesystem files via LOAD DATA INFILE, SELECT ... INTO OUTFILE, LOAD_FILE(), and similar.
检查方式
审计方法: 人工审核
此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。
SELECT User, Host FROM mysql.user WHERE File_priv = 'Y'; Confirm only accounts that genuinely require it hold this privilege.
修复方式
修复方法: 操作指南或基础设施补丁
REVOKE FILE ON *.* FROM 'username'@'host';
属性
- 操作系统
- 任意
- 标签
- tdsqlprivileges
- 参考
- CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 5.6 Ensure No Excessive `FILE` Privilege Grants