ntpd vs selinux

[Daniel J Walsh]

Usually when a confined daemon wants access to a seemingly random file, 
this indicates a leaked file descriptor.

So some application xdm/xserver opened the  .fonts.cache-2 file without 
the CLOSEXEC call.  So that all subprocesses inherit
the open file descriptor.  So your shell had this open file descriptor 
and then when you started ntpd it tried to access the descriptor
during startup, got denied and ignored it.  Why it disappeared later I 
do not know.

Dan