dolthub / dolthub/dolt

`secure_file_priv` warning is confusing

Open
#7,210 2 comments 5 reactions 0 assignees View on GitHub
bad error message enhancement
Dominant language
Go
Stars
24.4k
Forks
873
Avg merge
1d 5h
Merged PRs (30d)
108

Description

A default `dolt sql-server` includes the following warning statement on startup:
```
WARN[0000] secure_file_priv is set to "", which is insecure.
WARN[0000] Any user with GRANT FILE privileges will be able to read any file which the sql-server process can read.
WARN[0000] Please consider restarting the server with secure_file_priv set to a safe (or non-existent) directory.
```

This means that [`LOAD DATA INFILE`](https://dev.mysql.com/doc/refman/8.0/en/load-data.html) commands can access arbitrary files on disk. For example, any user of the database could read SSH key or other sensitive files on the server from the MySQL client.

The two ways to limit this risk are to 1) set the `secure_file_priv` to a folder limiting the file-system visibility, or 2) limit LOAD DATA privileges with GRANT statements.

Adding this line to the server `config.yaml` limits the LOAD DATA visibility to the working directory on startup, silencing the warning message:
```yaml
system_variables:
secure_file_priv: .
```

There are also [file-related GRANTS](https://dev.mysql.com/doc/refman/8.0/en/privileges-provided.html#priv_file) that have a similar effect at the user-level.

The current default for the LOAD DATA behavior simplifies importing data for first time users. The opposite behavior, requiring users to set the variable to LOAD DATA, would disable LOAD DATA by default and warn users how to enable. We may change the default in the future.

There are a lot of MySQL configuration options. Setting the system variables that MySQL uses is usually how we are going to support this sort of thing.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.