3 ms·
Even in that scenario it’s normal to run the database as a non-root user. This is important so that if there’s a database escape vulnerability, some sort of RCE
by danpalmer 3y ago
Even in that scenario it’s normal to run the database as a non-root user. This is important so that if there’s a database escape vulnerability, some sort of RCE, then the attacker doesn’t have full control over the machine and would still need another privilege escalation path to do the most damage.
You could skip this and run the DB as root, but that’s a big security trade off that most users shouldn’t be taking.
- viraptor 3y agoThat's not really a practical issue in most cases. In almost every situation if you attack the database host, there's nothing apart from the database running there. Once you control the database you have full data access already. You'll potentially need to escalate to enable outbound network access if it's restricted on the host rather than network layer, but even that's not common. For large databases you're more likely to get more access by changing trusted serialised data, or inject some commands where possible.
- danpalmer 3y agoHaving access to a restricted database user may well not grant access to all data, but being able to escape to the root system user could mean free access to the data reading it directly off disk. Root access also provides many more opportunities for persistence. Most attackers don't want to be discovered, they want to remain and continue to exfiltrate. Exfiltration out-of-band will also be easier as root as you would be able to modify the firewall. Root may be a little less useful on a cloud VM where there is cloud level network isolation etc, but it's still a Bad Idea.