Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Database Operation

|

247

Many public MySQL-based sites such as slashdot.org have migrated from MyISAM

to InnoDB.

Loading Datafiles

If you have FILE privileges, you can bulk load data from a flat file to a MySQL table.

This has obvious security implications.

The SQL LOAD DATA command reads a flat file on the database machine into a

MySQL table. This could be used to load /etc/passwd into a table, then read it with a

SQL SELECT statement. Since end users should not be stuffing files into tables, it’s

best to restrict this to administrative accounts. For example, if you need to load a flat

file into a particular table every day, create a MySQL account for that purpose and

grant it load privileges:

GRANT FILE ON database.table TO user@host identified by "password"

The SQL LOAD DATA LOCAL command allows the database server to read files

from the client. This permits an evil server to grab any file from the database client,

or an evil client to upload a file of its choice.

Recent versions of MySQL (3.23.49+ and 4.0.2+) are compiled to include an explicit

--enable-local-infile option for backward compatibility. To disable this ability

completely, they can be compiled without this option. Local loads can also be dis-

abled at runtime by starting mysqld with the

--local-infile=0 option.

Writing Data ...