Review the permissions granted to users via the operating system/file system on the instance files, database files, database redo, undo, archive, bin and audit log files, and database backup files. If any user/role who is not an authorized system administrator with a need to know or database administrator with a need to know, or a system account for running DBMS processes permitted to read/view any of these files, this is a finding. Note: When the instance and database directories are created by mysql installations packages, the permissions are secure and should not be changed. Run ls -l on the various files and directory. Permissions should be limited to the mysql user and mysql group. Use the following queries/commands to find the locations of instance directory, database directory, transaction logs directory, archive logs directory, audit logs directory, and backup files location. SELECT VARIABLE_NAME, VARIABLE_VALUE FROM performance_schema.global_variables WHERE VARIABLE_NAME LIKE '%dir' or VARIABLE_NAME LIKE '%file' order by VARIABLE_NAME; Regarding Linux default installation: Proper permissions are shown below. If the permissions are more permissive for a Location Type, this is a finding. The following table shows directory and file permissions for the generic binary distribution installation of MySQL Enterprise Edition for Linux x86-64 on Oracle Linux that is described in this guide. As indicated previously, most of the MySQL installation can be owned by root. The exceptions are the data directory, the error log file, the mysql-files directory, the pid file, and the socket file, to which the mysql user must have write access. Files and resources to which the mysql user requires read access include configuration files (/etc/my.cnf) and the MySQL binaries (for example /usr/local/mysql/bin). Desc/Typical Location Owner Directory File Permissions Permissions --------------------- ----- ----------- ----------- Client and utility programs directory /usr/local/mysql/bin root drwxr-xr-x mysqld server /usr/local/mysql/bin root drwxr-xr-x -rwxr-xr-x MySQL configuration file /etc/my.cnf root drwxr-xr-x -rw-r--r-- Data directory /usr/local/mysql/data mysql drwxr-x--- Error log file <directory where audit log files are located>/host_name.err mysql drwxr-x--- -rw------- secure_file_priv directory /usr/local/mysql/mysql-files mysql drwxr-x--- mysqld systemd service file /usr/lib/systemd/system/mysqld.service root drwxr-xr-x -rw-r--r-- systemd tmpfiles configuration file /usr/lib/tmpfiles.d/mysql.conf root drwxr-xr-x -rw-r--r-- pid file <directory where audit log files are located>/mysqld.pid mysql drwxr-x--- -rw-r----- socket file /tmp/mysql.sock mysql drwxrwxrwt srwxrwxrwx Unix manual pages directory /usr/local/mysql/man root drwxr-xr-x Include Header files directory /usr/local/mysql/include root drwxr-xr-x Libraries directory /usr/local/mysql/lib root drwxr-xr-x Miscellaneous support files directory /usr/local/mysql/support-files root drwxr-xr-x Miscellaneous files directory /usr/local/mysql/share root drwxr-xr-x