I found a setup that triggers it again (often but not always happening). Once reproducible I took backtraces of the sys open to see what in ntp does that.
Both opens are from the same place. Thread 1 "ntpd" hit Catchpoint 1 (returned from syscall open), 0x00007f8afd8fcd53 in __opendir (name=0x7ffc9999df90 "/usr/local/sbin") at ../sysdeps/posix/opendir.c:191 191 in ../sysdeps/posix/opendir.c (gdb) bt #0 0x00007f8afd8fcd53 in __opendir (name=0x7ffc9999df90 "/usr/local/sbin") at ../sysdeps/posix/opendir.c:191 #1 0x00007f8afe5c6ba7 in ?? () from /usr/lib/x86_64-linux-gnu/libopts.so.25 #2 0x00007f8afe5cdde6 in ?? () from /usr/lib/x86_64-linux-gnu/libopts.so.25 #3 0x00007f8afe5cfa4f in optionProcess () from /usr/lib/x86_64-linux-gnu/libopts.so.25 #4 0x000055c12781ae7f in parse_cmdline_opts (pargc=0x7ffc9999f0dc, pargv=0x7ffc9999f0d0) at ntpd.c:359 #5 0x000055c12781af8d in ntpdmain (argc=<optimized out>, argv=<optimized out>) at ntpd.c:575 #6 0x00007f8afd84a1c1 in __libc_start_main (main=0x55c12780b0e0 <main>, argc=8, argv=0x7ffc9999f6b8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffc9999f6a8) at ../csu/libc-start.c:308 #7 0x000055c12780b11a in _start () -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1741227 Title: apparmor denial to several paths to binaries To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1741227/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs