improvement(pam): explicitly disable LOCAL INFILE on MySQL backend connections

[lb-vn]

Description 📣

Addresses PAM-477

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

Just connect with MySQL as a smoke test

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[linear]

PAM-477

[greptile-apps]

Confidence Score: 4/5

The PR appears safe to merge from a current-runtime security perspective, but the capability should be disabled before handshake negotiation so the intended hardening is effective.

Findings

1.  Capability Cleared Too Late ▶

Summary

This PR attempts to harden PAM's MySQL backend connection by clearing the CLIENT_LOCAL_FILES capability after connecting.

• The capability is currently cleared only after handshake negotiation, so the backend still sees it advertised.
• The installed go-mysql version independently rejects LOCAL INFILE responses and does not access local files.

_{Reviews (1) · Last reviewed commit: "improvement(pam): explicitly disable LOC..."}