STIGQter STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must enforce discretionary access control policies, as defined by the data owner, over defined subjects, and objects.

DISA Rule

SV-253722r961317_rule

Vulnerability Number

V-253722

Group Title

SRG-APP-000328-DB-000301

Rule Version

MADB-10-006700

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Implement the organization's DAC policy in the security configuration of the database and DBMS, and, if applicable, the security configuration of the application(s) using the database.

To grant and revoke privileges, as the database administrator, use the following SQL syntax:

**To Grant User and Role privileges:

MariaDB> GRANT privilege ON database . table TO user|role ;

**To Revoke User and Role privileges:

MariaDB> REVOKE privilege_type ON database . table FROM user|role ;

Check Contents

Review system documentation to identify the required DAC.

Review the security configuration of the database and MariaDB. If applicable, review the security configuration of the application(s) using the database.

If the discretionary access control defined in the documentation is not implemented in the security configuration, this is a finding.

To check the permissions granted to a user use the following queries:

As the database administrator, run the following SQL:

**For user privileges:

Run this script to create the SHOW GRANTS script for each user:

MariaDB> SELECT DISTINCT CONCAT( 'SHOW GRANTS FOR ', user,'@', host,';') AS grantQuery FROM mysql.user WHERE is_role = 'N';

Run each SHOW GRANTS command for each user.

Verify that all users have the correct privileges. If they do not, this is a finding.

**For role privileges (except admin_option, whether the role can be granted by a particular use):

MariaDB> SELECT CONCAT('SHOW GRANTS FOR ',Role,';' ) FROM mysql.roles_mapping;

Run each SHOW GRANTS command for each role.

Verify that all roles have the correct privileges. If they do not, this is a finding.

**To determine if a role has admin_option (Whether the role can be granted by a particular user)

MariaDB> SELECT * FROM mysql.roles_mapping;

Verify that all privileges are correct. If they are not, this is a finding.

Vulnerability Number

V-253722

Documentable

False

Rule Version

MADB-10-006700

Severity Override Guidance

Review system documentation to identify the required DAC.

Review the security configuration of the database and MariaDB. If applicable, review the security configuration of the application(s) using the database.

If the discretionary access control defined in the documentation is not implemented in the security configuration, this is a finding.

To check the permissions granted to a user use the following queries:

As the database administrator, run the following SQL:

**For user privileges:

Run this script to create the SHOW GRANTS script for each user:

MariaDB> SELECT DISTINCT CONCAT( 'SHOW GRANTS FOR ', user,'@', host,';') AS grantQuery FROM mysql.user WHERE is_role = 'N';

Run each SHOW GRANTS command for each user.

Verify that all users have the correct privileges. If they do not, this is a finding.

**For role privileges (except admin_option, whether the role can be granted by a particular use):

MariaDB> SELECT CONCAT('SHOW GRANTS FOR ',Role,';' ) FROM mysql.roles_mapping;

Run each SHOW GRANTS command for each role.

Verify that all roles have the correct privileges. If they do not, this is a finding.

**To determine if a role has admin_option (Whether the role can be granted by a particular user)

MariaDB> SELECT * FROM mysql.roles_mapping;

Verify that all privileges are correct. If they are not, this is a finding.

Check Content Reference

M

Target Key

5475