How to Configure AlmaLinux 9 chrony Daemon for Hardware Timestamping Using Intel NICs

In secure Linux web hosting environments, running the NGINX web server as a non-root user (e.g., www-data) is standard practice. However, basic Discretionary Access Control (DAC)—relying solely on file permissions—is insufficient against sophisticated remote code execution (RCE) vulnerabilities. If an attacker exploits a flaw in a PHP backend or the NGINX binary itself, they can hijack the www-data process and traverse the filesystem, reading sensitive files like /etc/passwd or exfiltrating TLS private keys. To mitigate this, Debian Linux administrators must implement Mandatory Access Control (MAC) using AppArmor. By enforcing strict AppArmor profiles, you mathematically confine the NGINX worker processes, ensuring they can only access explicitly authorized directories, regardless of their user privileges.

Understanding AppArmor Confinement

AppArmor operates within the Linux kernel as a Linux Security Module (LSM). Unlike SELinux, which relies on complex inode labeling, AppArmor is path-based. An AppArmor profile explicitly defines the absolute filesystem paths a specific binary is permitted to read, write, or execute. If the NGINX binary attempts to access a path not explicitly permitted by its profile, the kernel intercepts the syscall and instantly denies access, logging the violation to the audit daemon.

Debian and Ubuntu enable AppArmor by default, but they do not enforce a strict profile for NGINX out of the box, as configurations vary wildly between deployments.

Installing AppArmor Utilities

To generate and manage profiles, ensure the core AppArmor utility packages are installed on your Debian server:

sudo apt update
sudo apt install apparmor-utils apparmor-profiles

Generating a Custom NGINX Profile using aa-genprof

Writing an AppArmor profile from scratch is complex. The most effective method is to use the aa-genprof utility, which places AppArmor into “learning mode.” It monitors the application’s behavior, logs every file it touches, and interactively asks the administrator whether to permit or deny that access in the final profile.

Stop the NGINX service and execute the profile generator targeting the absolute path of the NGINX binary:

sudo systemctl stop nginx
sudo aa-genprof /usr/sbin/nginx

The utility will instruct you to start the application in another terminal. Open a second SSH session and start NGINX:

sudo systemctl start nginx

Now, perform standard actions against your web server. Browse the website, upload a file, trigger a 404 error, and ensure all virtual hosts are accessed. This forces NGINX to touch all the configuration files, log directories, and web root folders it requires for normal operation.

Return to the first terminal and press S to scan the system log. The utility will present a list of files NGINX attempted to access (e.g., /etc/nginx/nginx.conf, /var/log/nginx/access.log, /var/www/html/index.html). For each prompt, press A to Allow or D to Deny. Once complete, press F to finish and save the profile.

Fine-Tuning the Profile

The generated profile is saved in /etc/apparmor.d/usr.sbin.nginx. Open this file in a text editor. You will see a list of path permissions.

#include <tunables/global>

/usr/sbin/nginx {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  # Allow reading configuration
  /etc/nginx/** r,
  
  # Allow reading web content
  /var/www/html/** r,
  
  # Allow writing logs
  /var/log/nginx/* w,
  
  # Allow access to PID and sockets
  /run/nginx.pid rw,
}

If you notice that /var/www/html/ only requires read (r) access, ensure there is no write (w) permission granted. This strict enforcement guarantees that even if NGINX is completely compromised, the attacker cannot deface the HTML files or upload a malicious webshell to that directory, because the kernel itself will block the write operation.

Enforcing the Profile

Once you are satisfied with the profile, you must load it into the kernel and transition it from complain/learning mode into strict enforcing mode.

sudo aa-enforce /etc/apparmor.d/usr.sbin.nginx
sudo systemctl reload apparmor
sudo systemctl restart nginx

You can verify the enforcement status by running sudo aa-status. NGINX will be listed under the “processes in enforce mode” section. If you suspect the profile is blocking legitimate traffic, you can check the kernel logs (dmesg | grep DENIED or /var/log/syslog) to see exactly which file access was blocked and adjust the profile accordingly.