Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-13353

CONNECT engine table_type=JDBC should not require FILE priv

Details

    Description

      For security reasons it would be great if we did not have to grant FILE permission to everyone who uses a CONNECT JDBC table. Currently we have to grant FILE to all users, even non-administrators, which increases the chance of data being leaked by accident. We do use secure_file_priv to help this, but ideally no user would need FILE priv, or if that isn't possible for some reason, at least not require FILE to use a connect JDBC table.

      Attachments

        Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-4500 ConnectSE: Excessive FILE privilege requirement for read-only operations

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Open

          Activity

            Ascending order - Click to sort in descending order
            View 11 older comments
            serg Sergei Golubchik added a comment -

            I vaguely remember that one can read text and csv files via ODBC, using "Text Driver". Is that correct?
            This was the reason for requiring FILE privilege for ODBC.

            serg Sergei Golubchik added a comment - I vaguely remember that one can read text and csv files via ODBC, using "Text Driver". Is that correct? This was the reason for requiring FILE privilege for ODBC.
            rdyas Robert Dyas added a comment -

            I think that is possible, but the person configuring the environment and install the drivers would be "responsible" for installing or not installing such a driver in this case. I don't think its a direct security concern of CONNECT, but could be a vulnerability if someone installed such a driver as the driver can run arbitrary code. Possibly worth documenting in a "Security Considerations" section.

            rdyas Robert Dyas added a comment - I think that is possible, but the person configuring the environment and install the drivers would be "responsible" for installing or not installing such a driver in this case. I don't think its a direct security concern of CONNECT, but could be a vulnerability if someone installed such a driver as the driver can run arbitrary code. Possibly worth documenting in a "Security Considerations" section.
            bertrandop Olivier Bertrand added a comment -

            Text Driver is a 32 bit Windows only driver incompatible with 64 bit applications. All servers on Linux are not concerned, only Windows 32 bit ones (unless accessed via the ODBC-ODBC Easysoft driver).
            Eventually, file privilege could be restored for Windows servers for ODBC. What do you think?

            bertrandop Olivier Bertrand added a comment - Text Driver is a 32 bit Windows only driver incompatible with 64 bit applications. All servers on Linux are not concerned, only Windows 32 bit ones (unless accessed via the ODBC-ODBC Easysoft driver). Eventually, file privilege could be restored for Windows servers for ODBC. What do you think?
            rdyas Robert Dyas added a comment -

            better to not require it in my opinion.

            rdyas Robert Dyas added a comment - better to not require it in my opinion.
            rdyas Robert Dyas added a comment -

            I'm not seeing this as fixed in the 10.2.14 change log:

            https://mariadb.com/kb/en/library/mariadb-10214-changelog/

            rdyas Robert Dyas added a comment - I'm not seeing this as fixed in the 10.2.14 change log: https://mariadb.com/kb/en/library/mariadb-10214-changelog/

            People

              bertrandop Olivier Bertrand
              rdyas Robert Dyas
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.