Assume an SQLi vulnerable web app running on a Linux system,
SELinux in enforcing mode. The MariaDB is running as a non-root user, say
Assume we are trying to take advantage of the SQLi vulnerability and using the
INTO OUTFILE we attempt to create a malicious PHP file in the server's web root (let's pretend that we now the location). AFAIK the web server should run in it's own user context, e.g. www-root. Would SELinux prevent this malicious file write to the web root directory and would I be able to see this attempt in log files ? If yes, were to look?