my server log has several entries like this:

leapseconds file /etc/ntp.leapseconds: Permission denied
[1195225.016830] type=1400 audit(1420833186.419:25): apparmor="DENIED" operation="open" profile="/usr/sbin/ntpd" name="/etc/ntp.leapseconds" pid=28627 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

I have been trying to setup the leapseconds file (obviously), yet ntp is giving me these errors on service restart. File permissions on ntp.leapseconds are sufficient (644, I have tried giving full permissions as well). I'm on Ubuntu 14.04.

Any idea why this is happening and how can I fix this?


I have no idea about if NTP should or should not access the file /etc/ntp.leapseconds However I can tell you why you are getting the problem.

the LSM apparmor is denying the read.

If you believe that NTP should have access to that file the correct solution would be to update the apparmor profile for ntp.

sudo vim /etc/apparmor.d/usr.sbin.ntpd

add a line that permits read access to the file in question eg.

/etc/ntp.leapseconds r,

save your file then reload the NTP profile

sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.ntpd

Why is this happening?

NTP has listening network sockets and has a pretty predictable behaviour , so usually ubuntu will ship a apparmor profile for it and turn it on by default.

Apparmor is a LSM ( Linux Security Module ) Its an extra layer of security called MAC ( Mandatory access control ) and its a way of telling an application what it can and cannot access via policy. It has the last say on access permissions and even if you chmod 777 a file if the policy says you are not permitted to access the file the kernel will deny access.

You can start learning here

  • By looking at the Apparmor config I found out that all files in /etc/ntp are allowed to be read by the service, so I opted for moving the file instead of modifying the default behavior. Apparmor is a new thing to me, thanks for pointing that out to me. – Aurielle Jan 9 '15 at 20:55
  • Excellent, Glad you fixed it, Apparmor is an excellent security tool. If you use RHEL, CentOS, or Fedora they have a similar LSM called SELINUX. – squareborg Jan 9 '15 at 20:57
  • Worked also in the case when I was unable to use a custom ntpd config with -c, and instead received getconfig: Couldn't open ...: Permission denied when started with -d for debugging. – Andris Mar 31 '20 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.