ntpd抱怨说无法访问自己的日志
# ntpd -qgddd ... 11 Sep 16:23:00 ntpd[7262]: can't open /var/log/ntpstats/peerstats.20130911: Permission denied ... 11 Sep 16:23:01 ntpd[7262]: can't open /var/log/ntpstats/peerstats.20130911: Permission denied ... 11 Sep 16:23:01 ntpd[7262]: can't open /var/log/ntpstats/loopstats.20130911: Permission denied 和strace同意
open("/var/log/ntpstats/loopstats.20130911", O_WRONLY|O_CREAT|O_APPEND, 0666) = -1 EACCES (Permission denied)
根据syslog apparmor阻止它这样做
[526597.819210] type=1400 audit(1378909374.692:91): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/usr/local/sbin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 [526597.819277] type=1400 audit(1378909374.692:92): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/usr/local/bin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 [526597.819330] type=1400 audit(1378909374.692:93): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/usr/sbin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 [526597.819383] type=1400 audit(1378909374.692:94): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/usr/bin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 [526597.819434] type=1400 audit(1378909374.692:95): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/sbin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 [526597.819485] type=1400 audit(1378909374.692:96): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/bin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 [526597.819541] type=1400 audit(1378909374.692:97): apparmor="DENIED" operation="open" parent=1013 profile="/usr/sbin/ntpd" name="/usr/bin/" pid=7262 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
尽pipe在ntp的configuration文件中显然是允许的
# less /etc/apparmor.d/usr.sbin.ntpd ... /var/log/ntpstats/clockstats* rwl, /var/log/ntpstats/loopstats* rwl, /var/log/ntpstats/peerstats* rwl, /var/log/ntpstats/rawstats* rwl, /var/log/ntpstats/sysstats* rwl,
发生什么了？
这是一个带有3.8.0-30-generic内核的Ubuntu Server 13.04。
该apparmor日志显示ntpd试图访问（读取）像/usr/local/sbin/ ， /usr/sbin/ etc 。 它不会告诉任何有关ntpd被拒绝访问/var/log/ntpstats 。
请检查/ var/log/ntpstats及其内容上的常规unix权限。