ntpsec access to openssl.conf DENIED by apparmor

[Eric Towers]

Ubuntu release: Ubuntu Server 22.04.1 LTS (amd64)
apparmor: 3.0.4-2ubuntu2.1 amd64
ntp: 1:4.2.8p15+dfsg-1ubuntu2 amd64
openssl: 3.0.2-0ubuntu1.6 amd64

In 2020, NTP gained OpenSSL support. [ https://fjordtek.com/categories/news/2020/openntpd-now-with-openssl-support/ ] This support requires read access to /etc/ssl/openssl.cnf . It is expected that ntpd is permitted to access openssl.cnf for this support. However, as reported in /var/log/syslog:

Oct 11 15:16:38 [trimmed] kernel: [...] audit: type=1400 audit([...]): apparmor="DENIED" operation="open" profile="/usr/sbin/ntpd" name="/etc/ssl/openssl.cnf" pid=1053 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

This seems to be caused by missing information in /etc/apparmor.d/usr.sbin.ntpd allowing ntpd to read the openssl config.

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: ntpsec (not installed)
ProcVersionSignature: Ubuntu 5.15.0-50.56-generic 5.15.60
Uname: Linux 5.15.0-50-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.1
Architecture: amd64
CasperMD5CheckResult: pass
Date: Tue Oct 11 15:35:23 2022
InstallationDate: Installed on 2022-05-05 (158 days ago)
InstallationMedia: Ubuntu-Server 22.04 LTS "Jammy Jellyfish" - Release amd64 (20220421)
ProcEnviron:
 TERM=xterm-256color
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: ntpsec
UpgradeStatus: No upgrade log present (probably fresh install)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.