4.7 Ensure the 'secure_file_priv' is Configured Correctly

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


The secure_file_priv option restricts to paths used by LOAD DATA INFILE or SELECT local_file. It is recommended that this option be set to a file system location that contains only resources expected to be loaded by MariaDB. Even better, if data import/export using LOAD DATA INFILE or SELECT local_file is not used, the functionality should be disabled entirely by setting --secure-file-priv to NULL.


Setting secure_file_priv reduces an attacker's ability to read sensitive files off the affected server via a SQL injection vulnerability.


Solutions that rely on loading data from various sub-directories may be negatively impacted by this change. Consider consolidating load directories under a common parent directory.

The server checks the value of secure_file_priv at startup and writes a warning to the error log if the value is insecure. A non-NULL value is considered insecure if it is empty, or the value is the data directory or a subdirectory of it, or a directory that is accessible by all users.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.


If you are not going to use this feature, remove secure_file_priv from the [mariadbd] section of the MariaDB configuration file and restart the MariaDB service.
If you need this feature add the following line to the [mariadbd] section of the MariaDB configuration file and restart the MariaDB service:


Default Value:

No value set.

See Also