The answer by Seth already covers how to interpret the message and the direct cause.
But the root cause might be that you have installed and configured libnss-ldap
but have not told AppArmor about it.
Ubuntu 12.04 is old enough to have libnss-ldap
, which has no separate service for sending LDAP queries out to the server(s); instead, it makes every process that uses glibc
have its own LDAP connection if they need LDAP-based name resolution services, according to /etc/nsswitch.conf
.
This is very inconvenient when using extra access control like AppArmor, because you'll effectively have to allow every process to access the LDAP client configuration and to make outgoing LDAP connections. And that is probably one of the reasons why libnss-ldap
fell out of favor and was replaced by libnss-ldapd
, which centralizes the job of making outgoing LDAP connections for name resolution to a dedicated service process. Unfortunately Ubuntu 12.04 LTS is old enough to not have had that package.
The default /etc/apparmor.d/abstractions/nameservice
file already includes the line:
#include <abstractions/ldapclient>
which should have covered the files required by libnss-ldap
.
Unfortunately, the /etc/apparmor.d/abstractions/ldapclient
file that is referred to by this line was adopted to Ubuntu 12.04 LTS unmodified from SuSE, and Ubuntu has slightly different paths for LDAP client configuration files. You would have to modify that file first to change the line
/etc/ldap.conf r,
to
/etc/ldap/ldap.conf r,
and similarly fix any other path referred to in the file to match actual Ubuntu file locations too.
After that, you would have to either reboot the system or use a command like
sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.ntpd
to refresh each AppArmor profile that is currently loaded (see sudo aa-status
for the list of loaded profiles).