logfile parameter not working on Ubuntu

Describe the Bug

logfile parameter is never working (target file is empty).

Expected Behavior

Logs should be written to the logfile target.

Steps to Reproduce

class { 'ntp':
  servers => ['ntp.ubuntu.com'],
  logfile => '/var/log/ntp.log',
}

Environment

Version 9.2.0
Platform: Ubuntu 20.04

Additional Context

Manual installation of ntp with logfile /var/log/ntp.log line in the /etc/ntp.conf works. Resulting file:

-rw-r--r--  1 root      root              1710 Sep 26 14:09 ntp.log

However this Puppet module will change the permissions to:

-rw-rw-r--  1 ntp       ntp                 822 Sep 26 14:12 ntp.log

Which somehow does not work:

# /var/log/syslog entry:
Sep 26 14:12:41 vm-focal ntpd[2462]: Cannot open logfile /var/log/ntp.log: Permission denied

I suspect this is related to AppArmor. Even if I cannot find any proof, it seems to work when the later is uninstalled.

Workaround:

class { 'ntp':
  servers => ['ntp.ubuntu.com'],
  logfile => '/var/log/ntp.log',
  logfile_user => 'root',
}

However, this works with /var/log/ntp.log only. If you try /var/log/ntp/ntp.log, AppArmor will explicitly deny the ntp daemon to access this file:

[  853.899701] audit: type=1400 audit(1664201792.505:73): apparmor="DENIED" operation="open" profile="/usr/sbin/ntpd" name="/var/log/ntp/ntp.log" pid=3409 comm="ntpd" requested_mask="ac" denied_mask="ac" fsuid=0 ouid=0

I'm not sure how this could be properly fixed. There is technically nothing wrong with the module itself, it's related to AppArmor restrictive/annoying behavior. Here are some ideas:

Defaults logfile_user value should be root (at least for Ubuntu).
Don't try to create or set permissions on the logfile, ntp is already able to create it (at least on Ubuntu).
Update the documentation of the logfile parameter for Ubuntu users.

puppetlabs / puppetlabs-ntp