http://bugzilla.opensuse.org/show_bug.cgi?id=1076247 http://bugzilla.opensuse.org/show_bug.cgi?id=1076247#c2 Christian Boltz <suse-beta@cboltz.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Stromeko@NexGo.DE Flags| |needinfo?(Stromeko@NexGo.DE | |) --- Comment #2 from Christian Boltz <suse-beta@cboltz.de> --- One of the upstream developers doubts the 'l' (link) permission is really needed, and since I don't have a stratum-0 refclock, I'd like to ask you to test this ;-) Can you please change your added rule to /var/log/ntpstats/clockstats* rw, Then run "rcapparmor reload" and report back if ntpd causes any log events (ALLOWED or DENIED) in /var/log/audit/audit.log? (If you don't have auditd running, check /var/log/messages or journalctl.) For bonus points, also temporarily remove the 'l' permission from the other /var/log/ntpstats/loopstats* and peerstats* rules, run aa-complain /etc/apparmor.d/usr.sbin.ntpd to switch the profile into complain mode and then provide the audit.log entries ntpd triggers. Note: complain mode allows everything and logs what would be denied, so even if something is missing in the profile, ntpd will work. To switch the profile back to enforce mode, run aa-enforce /etc/apparmor.d/usr.sbin.ntpd -- You are receiving this mail because: You are on the CC list for the bug.