4 ms·

This is an issue that something like openbsd's pledge can prevent. No reason for the MySQL client to be able to read arbitrary files on the system. https://man

• shawnz 8y ago
  Pledge could only prevent this by effectively disabling the feature entirely. If you were to implement the necessary logic to determine which "LOCAL DATA" statements were legal and which weren't, it would be trivial from that point to block the illegal ones with or without pledge. Pledge is meant to be used for stopping your software from doing unanticipated things, not anticipated things. In this case they anticipated this behavior and purposely kept it even though it's potentially dangerous. EDIT: Sorry, perhaps you meant that the application which is embedding the MySQL client ought to use pledge. In that case, that does seem like a good defensive usage of pledge which would prevent this kind of attack, notwithstanding the need to fix the issue in the client itself.
• wolf550e 8y ago
  And if you use mysql client to upload files to the mysql server (like csv files) then you could invoke the mysql client with a command line argument saying "I intend to send files from this directory to the server" and pledge would let the process read files from that directory but not others.
• giornogiovanna 8y ago
  This is incredibly off-topic, but can I use pledge as a sandbox by pledging and then execve-ing?
  • throwawaypled 8y ago
    if you pass the `execpromises` parameter, and make sure that the flags DO NOT include the ability to further execve() (the `exec` flag), then yes, but openbsd pledge flags are not implicitly inherited like linux seccomp filters.