You probably know that AppArmor contains a profile for ntpd. 

I noticed in the audit.log that ntpd wants to read the directory listing
(basically "ls") of all directories in $PATH (/bin, /sbin, /usr/bin, /usr/sbin,
/usr/local/bin and /usr/local/sbin).

Do you have an idea why ntpd wants/needs those directory listings?
(I didn't notice any problems when denying those permissions, but maybe my
config is too simple ;-)

Do you think I need to allow them in the AppArmor profile? Or should I deny
them (to silence the logging)?