[pkg-ntp-maintainers] Bug#883022: ntp does not start with current AppArmor profile

[Nuno Oliveira]

Package: ntp
Version: 1:4.2.8p10+dfsg-5
Severity: important

Dear Maintainer,

With the current apparmor profile, the ntp daemon does not start. The log is:

type=SERVICE_STOP msg=audit(1511903874.826:12511): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=ntp comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1511903874.837:12512): apparmor="DENIED" operation="open" profile="/usr/sbin/ntpd" name="/usr/local/sbin/" pid=27228 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
type=SYSCALL msg=audit(1511903874.837:12512): arch=c000003e syscall=2 success=no exit=-13 a0=7ffd1600eaa0 a1=90800 a2=7ffd1600eab0 a3=0 items=0 ppid=1 pid=27228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" key=(null)
type=PROCTITLE msg=audit(1511903874.837:12512): proctitle=2F7573722F7362696E2F6E747064002D70002F7661722F72756E2F6E7470642E706964002D67002D75003130373A313234
type=AVC msg=audit(1511903874.837:12513): apparmor="DENIED" operation="open" profile="/usr/sbin/ntpd" name="/usr/local/bin/" pid=27228 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
type=SYSCALL msg=audit(1511903874.837:12513): arch=c000003e syscall=2 success=no exit=-13 a0=7ffd1600eaa0 a1=90800 a2=7ffd1600eaaf a3=0 items=0 ppid=1 pid=27228 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ntpd" exe="/usr/sbin/ntpd" key=(null)
type=PROCTITLE msg=audit(1511903874.837:12513): proctitle=2F7573722F7362696E2F6E747064002D70002F7661722F72756E2F6E7470642E706964002D67002D75003130373A313234
type=SERVICE_START msg=audit(1511903874.842:12514): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=ntp comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

Thanks,

Nuno.


-- System Information:
Debian Release: buster/sid
  APT prefers testing
  APT policy: (700, 'testing'), (650, 'unstable'), (600, 'stable'), (300, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.13.0-1-amd64 (SMP w/12 CPU cores)
Locale: LANG=pt_PT.UTF8, LC_CTYPE=pt_PT.UTF8 (charmap=UTF-8) (ignored: LC_ALL set to pt_PT.UTF8), LANGUAGE=pt_PT:pt_BR:en (charmap=UTF-8) (ignored: LC_ALL set to pt_PT.UTF8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages ntp depends on:
ii  adduser              3.116
ii  dpkg                 1.19.0.4
ii  init-system-helpers  1.51
ii  libc6                2.25-2
ii  libcap2              1:2.25-1.1
ii  libedit2             3.1-20170329-1
ii  libopts25            1:5.18.12-3
ii  libssl1.1            1.1.0g-2
ii  lsb-base             9.20170808
ii  netbase              5.4
ii  tzdata               2017c-1

Versions of packages ntp recommends:
ii  perl  5.26.1-2
ii  sntp  1:4.2.8p10+dfsg-5

Versions of packages ntp suggests:
ii  ntp-doc  1:4.2.8p10+dfsg-5

-- Configuration Files:
/etc/ntp.conf changed [not included]

-- no debconf information


-- System Information:
Debian Release: buster/sid
  APT prefers testing
  APT policy: (700, 'testing'), (650, 'unstable'), (600, 'stable'), (300, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.13.0-1-amd64 (SMP w/24 CPU cores)
Locale: LANG=pt_PT.UTF8, LC_CTYPE=pt_PT.UTF8 (charmap=UTF-8) (ignored: LC_ALL set to pt_PT.UTF8), LANGUAGE=pt:pt_BR:en (charmap=UTF-8) (ignored: LC_ALL set to pt_PT.UTF8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages ntp depends on:
ii  adduser              3.116
ii  dpkg                 1.19.0.4
ii  init-system-helpers  1.51
ii  libc6                2.24-17
ii  libcap2              1:2.25-1.1
ii  libedit2             3.1-20170329-1
ii  libopts25            1:5.18.12-3
ii  libssl1.1            1.1.0g-2
ii  lsb-base             9.20170808
ii  netbase              5.4
ii  tzdata               2017c-1

Versions of packages ntp recommends:
ii  perl  5.26.1-2
ii  sntp  1:4.2.8p10+dfsg-5

Versions of packages ntp suggests:
ii  ntp-doc  1:4.2.8p10+dfsg-5

-- Configuration Files:
/etc/ntp.conf changed [not included]

-- no debconf information