finalize a chrony apparmor profile and enable it by default

[Christian Ehrhardt ]

Hi,
there currently is no chrony apparmor profile so please add one.
This could be based on the ntp profile minus all the special HW it needed to access (which chrony only does through gpsd).

It might need a few extra rules for GPSD shared memory access.

1. create initial template bases on ntp
2. stip ntpd only rules
3. study gpsd usage, add rules
4. run tests for common cases if we hit false denies
5. add to the package as default enabled

[Jamie Strandboge (jdstrand)]

This is now done in https://launchpad.net/ubuntu/+source/chrony/3.2-1ubuntu1 (sorry, I didn't realize this bug existed).

Here is the upstream submission: https://gitlab.com/apparmor/apparmor-profiles/merge_requests/10

Here is the Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=888038

[Christian Ehrhardt  (paelzer)]

I like the solution for ipc_owner with a comment and the reference.
That is the best safe&working tradeoff for this case I can think of.
Thanks Jamie!