Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Cannot disable LOCAL INFILE ( for security reasons ) in mysql Ver 14.14 Distrib 5.5.25a, for debian-linux-gnu (i686) using readline 6.2 on ubuntu 12.04; Here is my /etc/mysql/my.cnf

[client]
port            = 3306
socket          = /var/run/mysqld/mysqld.sock
loose-local-infile=0
local-infile=0

[mysqld_safe]
socket          = /var/run/mysqld/mysqld.sock
nice            = 0

[mysqld]
local-infile=0
user            = mysql
pid-file        = /var/run/mysqld/mysqld.pid
socket          = /var/run/mysqld/mysqld.sock
port            = 3306
basedir         = /usr
datadir         = /var/lib/mysql
tmpdir          = /tmp
lc-messages-dir = /usr/share/mysql
skip-external-locking

I do

sudo /etc/init.d/mysql restart

mysql -u root -p

mysql> SELECT load_file("/etc/passwd");

And it shows me my /etc/passwd content. So it didn't work.

share|improve this question

migrated from stackoverflow.com Aug 21 '12 at 8:06

This question came from our site for professional and enthusiast programmers.

    
before firing your select query, try the statement "show variables like "load_infile"" and check if your change has taken effect or not. –  shubhansh Aug 20 '12 at 14:53
    
SHOW VARIABLES shows | local_infile | OFF –  FoREacH Aug 20 '12 at 17:00
    
LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE table1 -> ; ERROR 1148 (42000): The used command is not allowed with this MySQL version ===> ALL WORKS, but SELECT load_file("/etc/passwd"); loads file ! –  FoREacH Aug 20 '12 at 17:19
    
This belongs on Ask Ubuntu. –  Esoteric Screen Name Aug 20 '12 at 20:58

1 Answer 1

From MySQL Docs for load_file reference, it can be seen that load_file is MySQL function that returns content of the file as string. It does nothing more than that. It has nothing to do with local_infile.

For security purpose, from same docs:

If the secure_file_priv system variable is set to a nonempty directory name, the file to be loaded must be located in that directory.

So if you set the system variable "secure_file_priv", then file has to be present in that particular directory. Moreover, user requires File level privileges to execute this statement. Simply do not give file level privileges to your users who are accessing database, if you want it to be secured.

Further local-infile is for LOAD DATA statements, which loads data into table, thereby affecting tables. It has nothing to do with load_file() function.

share|improve this answer
    
Thanks for the great answer :) –  FoREacH Aug 22 '12 at 9:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.