Hi @thomaszbz Thanks for the suggestion to improve the documentation about this feature.

since you seem knowledgeable about the security implications, maybe you would be able to paste here your suggested updated text for this FAQ? it would help us make this change faster. cheers

As @thomaszbz explain on https://issues.piwik.org/7519 and @mattab commented about improving the documentation these where the steps I did on my Piwik installation just in case someone of you want to update https://piwik.org/faq/troubleshooting/#faq_194:

How do I get LOAD DATA INFILE to work on my server?

Piwik processes huge amount of data and then stores this data in the database. For improved performance, Piwik tries to import a lot of data in the database at once using a Mysql feature called “LOAD DATA INFILE”. You can check whether your server supports this performance improvement in Administration > System Check menu. The system checks two commands: LOAD DATA INFILE and LOAD DATA LOCAL INFILE. It’s enough if either one of these work.

In order to do this, connect to your webserver with SSH. You'll need ROOT ACCESS OR ROOT PERMISSIONS.

ssh root@your_webserver.com

First check that the sql user that Piwik is using has the permission to import the files:

mysql -u root -p 
GRANT FILE on your_db_name.* to piwik@localhost;
exit

Check the “mysqld” process can access the file created in the tmp/assets directory in the piwik-installation: give the process mysqld read-access to files in path/to/piwik/tmp/assets/* and all parent folders.

path/to/piwik/tmp/# chmod -R 755 assets/

check that the request isn’t blocked by apparmor or any other security-software when accessing this folder. If you are using Ubuntu, you may have to disable apparmor which prevents mysql from accessing files in path/to/piwik/tmp/* Edit the file /etc/apparmor.d/usr.sbin.mysqld and add the following path in the file:

vim /etc/apparmor.d/usr.sbin.mysqld

	# Allow piwik access tmp files
	  path/to/piwik/tmp/assets/* rw,

Restart apparmor:

sudo /etc/init.d/apparmor restart

in your Mysql configuration (my.cnf) set the following options: [mysqld] local-infile, secure-file-priv = "" and [mysql] local-infile

vim /etc/mysql/my.cnf
	
	[mysqld]
	local-infile=1
	secure-file-priv = ""
	[mysql]
	local-infile=1

Restart mysql:

sudo service mysql restart

Now you can have that nice "Huzzah! There are no problems with your Piwik setup. Give yourself a pat on the back." message on Piwik's System Check page.

@fortinux Nice catch. It's just that ordinary web space hosters won't let anyone change an apparmor profile. Now that the documentation already suggests to do exactly that, it should be documented that this step requires root access.

Hi,

I just started out using Matomo and you should really rework this mentioned section in the help.
I am sorry to say, this is not offending, but it is as insecure and wrong as it could get.
You propose to set the FILE grant for the db user and then in the same section you propose to set the directory permissions and set local-infile. This absolutely makes no sense at all, either you use LOAD DATA INFILE : Then you need to grant a FILE permission to the user and make the directory accessible somehow, this is true. But then you don't need local_infile option at all. For what?
Or you use local_infile, then you absolutely don't need the other steps, no FILE grant and no directory permissions for mysqld process as LOAD DATA LOCAL does exactly not need that because it is read by the "client" which has access anyways and is "uploaded" to the server. I put this in "" because this also works if you are just working on localhost.
But as load_infile works only as a global setting like @thomaszbz mentioned this completely opens up your whole mysql install.
Users have a lot of problems to get LOAD DATA to work properly, but this is for sure not the optimal way. Most of them give up and just enable LOCAL, many without knowing the risks.
They should use either one of it not open up everything.
@thomaszbz sadly your suggestion to grant file on db.* makes no sense because this is even not possible. FILE is a global privilege and cannot be used on db level. You give the user all access for the server. That's it. If you have to use LOAD DATA you have to choose to open up directories that might be closed otherwise for 'mysql' user or use insecure LOAD DATA LOCAL.
This is not the best way to get it, especially for users that might have their install in /home/... directories, which is the case for many that use webpanel software. Won't get deeper into it in a public thread.
But there would be really easy and far more secure ways to handle that. Really easy. Please consider that.

EDIT :
as you can see in a previous comment @fortinux did exact that. He opened up both LOAD DATA possibility and then on top activated LOAD DATA LOCAL which makes the first things complete obsolete. This is not good

Nothing seems to have happend for a very long time. What is the status here?