Issue
I was wondering if someone knowing my MySQL 5.7 root password can execute a stored procedure, access the file system and compromise the system remotely.
Solution
Root, or more correctly a SUPER granted user, can execute any procedures.
Access to the filesystem is limited by:
- https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_secure_file_priv (Dynamic NO means it can't be changed while running, enven by SUPER).
On the assumption there is a code execution bug in mysql they could exploit, overall the mysqld server process runs as the mysql user and will be limited by that privilege along with the selinux rules that Fedora applies.
SUPER will be able to fill up a filesystem (like any user with INSERT access), create a mess of the database files, but otherwise any generally filesystem is quite limited.
This all applies whether local or remote. Keep in mind that root@localhost is accessibly only locally. root@% is a distinct remote user.
Answered By - danblack
