STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

Access to external executables must be disabled or restricted.

DISA Rule

SV-253692r960963_rule

Vulnerability Number

V-253692

Group Title

SRG-APP-000141-DB-000093

Rule Version

MADB-10-003400

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

To disable LOAD DATA LOCAL INFILE make the following update as the database administrator:

Edit the mariadb-enterprise.cnf configuration file located in /etc/my.cnf.d/.

Under [mariadb], add the following:

local_infile = 0

Save the configuration file. This change will not take effect until MariaDB Enterprise Server is restarted.

To remove FILE and GRANT OPTION privileges use the right combination of the following commands:
1. revoke FILE privilege from a user
MariaDB> REVOKE FILE FROM 'user'@'host';

2. revoke FILE privilege from a role
MariaDB> REVOKE FILE FROM role;

3. revoke GRANT OPTION privilege from a user
MariaDB> REVOKE GRANT OPTION FROM 'user'@'host';

4. revoke a role grant from a user
MariaDB> REVOKE ROLE FROM grantee;

Check Contents

MariaDB's LOAD DATA LOCAL INFILE command can interact with the server's underlying OS.

To check the value of this option, run the following command as the database administrator:

MariaDB> SHOW GLOBAL VARIABLES LIKE 'local_infile';

Verify the option is set according to the security guide. If it is not, this is a finding.

If the value of local_infile is set to ON per the security guide, user privileges must be checked. Only users with FILE privilege can use the LOAD DATA LOCAL INFILE command.

To check the users who have FILE privilege against the security guide, run the following commands as the database administrator.

1. Check which users have FILE privilege and GRANT OPTION privileges and compare to the security guide to determine if a user has FILE privilege that should not or if a user has GRANT OPTION and should not.

If the users have privileges they should not have, this is a finding.

Run this script to create the SHOW GRANTS script for each user:
MariaDB> SELECT DISTINCT CONCAT( 'SHOW GRANTS FOR ', user,'@', host,';') AS grantQuery FROM mysql.user WHERE is_role = 'N';

Run each SHOW GRANTS command for each user.
MariaDB> SHOW GRANTS FOR 'user'@'host';

2. Check which roles have FILE privilege and GRANT OPTION privileges and compare to the security guide to determine if a role has FILE privilege that should not or if a role has GRANT OPTION and should not.

If the roles have privileges they should not have, this is a finding.

MariaDB> SELECT DISTINCT CONCAT('SHOW GRANTS FOR ',role, ';') FROM mysql.roles_mapping;

Run each SHOW GRANTS command for each role.

3. From the two outputs above, check which users and roles can set roles and grant privileges by checking who has GRANT OPTION and FILE privileges and comparing to the security guide.

If any user or role has GRANT OPTION or FILE privileges they should not have, this is a finding.

Vulnerability Number

V-253692

Documentable

False

Rule Version

MADB-10-003400

Severity Override Guidance

MariaDB's LOAD DATA LOCAL INFILE command can interact with the server's underlying OS.

To check the value of this option, run the following command as the database administrator:

MariaDB> SHOW GLOBAL VARIABLES LIKE 'local_infile';

Verify the option is set according to the security guide. If it is not, this is a finding.

If the value of local_infile is set to ON per the security guide, user privileges must be checked. Only users with FILE privilege can use the LOAD DATA LOCAL INFILE command.

To check the users who have FILE privilege against the security guide, run the following commands as the database administrator.

1. Check which users have FILE privilege and GRANT OPTION privileges and compare to the security guide to determine if a user has FILE privilege that should not or if a user has GRANT OPTION and should not.

If the users have privileges they should not have, this is a finding.

Run this script to create the SHOW GRANTS script for each user:
MariaDB> SELECT DISTINCT CONCAT( 'SHOW GRANTS FOR ', user,'@', host,';') AS grantQuery FROM mysql.user WHERE is_role = 'N';

Run each SHOW GRANTS command for each user.
MariaDB> SHOW GRANTS FOR 'user'@'host';

2. Check which roles have FILE privilege and GRANT OPTION privileges and compare to the security guide to determine if a role has FILE privilege that should not or if a role has GRANT OPTION and should not.

If the roles have privileges they should not have, this is a finding.

MariaDB> SELECT DISTINCT CONCAT('SHOW GRANTS FOR ',role, ';') FROM mysql.roles_mapping;

Run each SHOW GRANTS command for each role.

3. From the two outputs above, check which users and roles can set roles and grant privileges by checking who has GRANT OPTION and FILE privileges and comparing to the security guide.

If any user or role has GRANT OPTION or FILE privileges they should not have, this is a finding.

Check Content Reference

M

Target Key

5475