ntpd profile denies access to /etc/ld.so.preload

[Michael Fritscher]

Binary package hint: ntp

loads of [225858.247276] type=1502 audit(1270850063.287:6656): operation="file_mmap" pid=16584 parent=16579 profile="/usr/sbin/ntpd" requested_mask="r::" denied_mask="r::" fsuid=0 ouid=0 name="/etc/ld.so.preload"

[Mathias Gug (mathiaz)]

Could you provide more information about which version of the package you're running?

[Michael Fritscher (michael-fritscher)]

current from lucid beta: Version: 1:4.2.4p8+dfsg-1ubuntu2

[Jamie Strandboge (jdstrand)]

I'll mark this as Triaged, but I'm thinking that the profile is doing its job. From the ld.so man page:

/etc/ld.so.preload: File containing a whitespace separated list of ELF shared libraries to be loaded before the program. libraries and an ordered list of candidate libraries.

IMO, if the administrator wants to use /etc/ld.so.preload, then he/she should update the profile accordingly. This makes sense too because if the administrator updated /etc/ld.so.preload, there is a good chance the profile would have to be updated to allow access to the preload libraries anyway (ie simply adding this to the profile doesn't really 'fix' it).

Michael, if you want access to /etc/ld.so.preload (keeping in mind you may need to make other changes), please add to /etc/apparmor.d/usr.sbin.ntpd:
  /etc/ld.so.preload r,

then perform:
$ sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.ntpd

[Chuck Short (zulcss)]

I second this based on Jamie's comments and marking this as wont fixed.

Regards
chuck

[Jamie Strandboge (jdstrand)]

Michael, alternatively, if you don't want ntpd to access /etc/ld.so.preload but want to silence the message, please add to /etc/apparmor.d/usr.sbin.ntpd:
  deny /etc/ld.so.preload r,

then perform:
$ sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.ntpd

[Michael Fritscher (michael-fritscher)]

it seems that many programs seem to want to access this file...
I didn't ever touched this file, it is even empty (it is from 26.7.2009) - if it helps I could even delete this file...

[Jamie Strandboge (jdstrand)]

Michael, if you aren't using it, it is fine to delete.