SQLi vulnerability vs SELinux

Question

Assume an SQLi vulnerable web app running on a Linux system, SELinux in enforcing mode. The MariaDB is running as a non-root user, say db_user. Assume we are trying to take advantage of the SQLi vulnerability and using the INTO OUTFILE we attempt to create a malicious PHP file in the server's web root (let's pretend that we now the location). AFAIK the web server should run in it's own user context, e.g. www-root. Would SELinux prevent this malicious file write to the web root directory and would I be able to see this attempt in log files ? If yes, were to look?

Thank you!

Answer 1

I am not an expert on SELinux (I use AppArmor) but generally I'd say it can prevent such attack, but it depends on the configuration.

Generally, SELinux should confine the SQL server to writes only in the directories it is supposed to, like /var/lib/mysql or /var/log/mysql. These are places, where the insecure app has no place to be (and should be stopped by either Unix rights or SELinux) before accessing such files and directories.

Any attempts to break such rules will be logged in auditd logfile, location varies among distributions

However, this has some caveats:

• This limits your usage of INTO OUTFILE in your app to a big extent
• Should attacker has such access to SQL injection that he can make an outfile, they can probably also get the data in a different manner, such as crafting different selects and scraping the data from the app. It requires some more work, but can be reasonably automated

So yes, if configured properly it can prevent such attack, but it does not prevent SQL injections attack in general, only those that rely on INTO OUTFILE