5

ntpd complains that it cannot access its own logs

# ntpd -qgddd 
...
11 Sep 16:23:00 ntpd[7262]: can't open /var/log/ntpstats/peerstats.20130911: Permission denied
...
11 Sep 16:23:01 ntpd[7262]: can't open /var/log/ntpstats/peerstats.20130911: Permission denied
...
11 Sep 16:23:01 ntpd[7262]: can't open /var/log/ntpstats/loopstats.20130911: Permission denied

and strace agrees

open("/var/log/ntpstats/loopstats.20130911", O_WRONLY|O_CREAT|O_APPEND, 0666) = -1 EACCES (Permission denied)

According to syslog apparmor blocks it from doing that

[526597.819210] type=1400 audit(1378909374.692:91): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/usr/local/sbin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[526597.819277] type=1400 audit(1378909374.692:92): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/usr/local/bin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[526597.819330] type=1400 audit(1378909374.692:93): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/usr/sbin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[526597.819383] type=1400 audit(1378909374.692:94): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/usr/bin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[526597.819434] type=1400 audit(1378909374.692:95): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/sbin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[526597.819485] type=1400 audit(1378909374.692:96): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/bin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[526597.819541] type=1400 audit(1378909374.692:97): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/usr/bin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

even though it's clearly allowed in ntp's profile

# less /etc/apparmor.d/usr.sbin.ntpd
...
/var/log/ntpstats/clockstats* rwl,
/var/log/ntpstats/loopstats*  rwl,
/var/log/ntpstats/peerstats*  rwl,
/var/log/ntpstats/rawstats*   rwl,
/var/log/ntpstats/sysstats*   rwl,

So what's going on?

It's an Ubuntu Server 13.04 with 3.8.0-30-generic kernel.

1

That apparmor log shows that ntpd tries to access (read) directories like /usr/local/sbin/, /usr/sbin/ etc. It doesn't tell anything about ntpd being denied access to /var/log/ntpstats.

Please check regular unix permissions on /var/log/ntpstats and its contents.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.