Description of problem: When the ntp server tries to write to its drift file, it gets an avc denial. Version-Release number of selected component (if applicable): selinux-policy-targeted-2.4.3-2.fc6 ntp-4.2.2p1-3 How reproducible: Always Steps to Reproduce: 1. Boot system with ntp active 2. Wait 3. Actual results: avc denial Expected results: no avc denial Additional info: SYSLOG: ntpd[1563]: can't open /etc/ntp/ntp.drift.TEMP: Permission denied AUDIT LOG: type=AVC msg=audit(1163805144.503:65): avc: denied { write } for pid=1563 comm="ntpd" name="ntp" dev=md1 ino=5342396 scontext =system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir type=SYSCALL msg=audit(1163805144.503:65): arch=40000003 syscall=5 success=no exit=-13 a0=95c6e50 a1=241 a2=1b6 a3=95c7890 items =0 ppid=1 pid=1563 auid=4294967295 uid=38 gid=38 euid=38 suid=38 fsuid=38 egid=38 sgid=38 fsgid=38 tty=(none) comm="ntpd" exe="/ usr/sbin/ntpd" subj=system_u:system_r:ntpd_t:s0 key=(null)
drift files are supposed to go in /var/lib/ntp. Otherwize you need to write custom policy In my /etc/ntp.conf it says. # Drift file. Put this in a directory which the daemon can write to. # No symbolic links allowed, either, since the daemon updates the file # by creating a temporary in the same directory and then rename()'ing # it to the file. driftfile /var/lib/ntp/drift