/run/systemd/userdb read access requested by random apps such as ntpd and avahi-daemon since systemd 245
Here is a sample log:
type=AVC msg=audit(1583883237.394:83): apparmor="DENIED" operation="open" profile="avahi-daemon" name="/run/systemd/userdb/" pid=1100 comm="avahi-daemon" requested_mask=" r" denied_mask="r" fsuid=0 ouid=0 type=AVC msg=audit(1583883239.157:103): apparmor="DENIED" operation="open" profile="ntpd" name="/run/systemd/userdb/" pid=1393 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
File /etc/apparmor.d/usr.sbin.ntpd should be modified to have access to /run/systemd/userdb?