This is not reproducible:
# getenforce
Enforcing
# systemctl stop chronyd.service
# systemctl mask chronyd.service
Created symlink /etc/systemd/system/chronyd.service → /dev/null.
# puppet resource service chronyd.service enable=true ensure=running
Notice: /Service[chronyd.service]/ensure: ensure changed 'stopped' to 'running'
service { 'chronyd.service':
ensure => 'running',
enable => 'true',
provider => 'systemd',
}