Title

MariaDB must generate audit records when privileges/permissions are modified. (Cat II impact)

Discussion

Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. In the MariaDB environment, modifying permissions is done via the GRANT, and REVOKE commands.

Check Content

Verify the MariaDB Enterprise Audit plugin is loaded and actively logging: MariaDB> SHOW GLOBAL STATUS LIKE 'Server_audit_active'; If the MariaDB Enterprise Audit is not active, this is a finding. Check what filters are in place by running the following as an administrative user: MariaDB> SELECT * FROM mysql.server_audit_filters; Verify query_events includes DCL or ALL in corresponding audit filters. If not, this is a finding. In one terminal, tail the audit log file. For example: $ tail -F /var/lib/mysql/server_audit.log (default location) Open a new terminal and connect to the database. As the database administrator, create a user without special permissions: MariaDB> CREATE USER 'user_name_here'@'localhost' IDENTIFIED BY 'password_here'; As the database administrator, create a role by running the following SQL: MariaDB> CREATE ROLE 'role_name_here'; As the database administrator, GRANT role to testuser: MariaDB> GRANT 'role_name_here' TO 'user_name_here'@'localhost'; As the database administrator, add privileges to user_role for testdb, and add GRANT role to testuser: MariaDB> GRANT SELECT ON db_name_here TO 'user_name_here'@'localhost'; MariaDB> GRANT SELECT ON db_name_here TO 'role_name_here'; As the database administrator, modify privileges for testuser and user_role: MariaDB> GRANT DELETE ON db_name_here TO 'user_name_here'@'localhost'; MariaDB> GRANT DELETE ON db_name_here TO 'role_name_here'; If the audit records are not produced for successful attempts to modify privileges/permissions and roles in the first terminal, this is a finding.

Fix Text

The MariaDB Enterprise Audit plugin can be configured to audit these changes. Update necessary audit filters to include query_event ALL. Example: MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default'; MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule) VALUES ('default', JSON_COMPACT( '{ "connect_event": [ "CONNECT", "DISCONNECT" ], "query_event": [ "ALL" ] }' ));

Additional Identifiers

Rule ID: SV-253752r961800_rule

Vulnerability ID: V-253752

Group Title: SRG-APP-000495-DB-000328

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.