Apparmor config does not allow pcap cyclic buffer

[Robert Bakker]

tcp dump comes with a apparmor file

/etc/apparmor.d/usr.sbin.tcpdump

that tells to can write .pcap files:

# for -r, -F and -w
/**.[pP][cC][aA][pP] rw,

but using the -W and -C modes it will also write pcap0 etc. files

we've put apparmor in complain mode as a workaround

------
lsb_release -rd
version: 4.9.0-1ubuntu1~ubuntu12.04.1

Description: Ubuntu 12.04.4 LTS
Release: 12.04
------
apt-cache policy tcpdump
tcpdump:
  Installed: 4.9.0-1ubuntu1~ubuntu12.04.1
  Candidate: 4.9.0-1ubuntu1~ubuntu12.04.1
  Version table:
 *** 4.9.0-1ubuntu1~ubuntu12.04.1 0
        500 http://nl.archive.ubuntu.com/ubuntu/ precise-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu/ precise-security/main amd64 Packages
        100 /var/lib/dpkg/status
     4.5.1-2ubuntu1~ubuntu12.04.1 0
        100 http://nl.archive.ubuntu.com/ubuntu/ precise-backports/main amd64 Packages
     4.2.1-1ubuntu2 0
        500 http://nl.archive.ubuntu.com/ubuntu/ precise/main amd64 Packages

[Kurt (kurtabersold)]

I added /**.[pP][cC][aA][pP]* rw, to /etc/apparmor.d/local/usr.sbin.tcpdump to allow for rotated pcap files.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Trent Lloyd (lathiat)]

This was fixed upstream in Debian:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010688

That change was added to 4.99.1-4 which first shipped in Jammy

$ rmadison tcpdump
 tcpdump | 4.5.1-2ubuntu1 | trusty | source, amd64, arm64, armhf, i386, powerpc, ppc64el
 tcpdump | 4.7.4-1ubuntu1 | xenial | source, amd64, arm64, armhf, i386, powerpc, ppc64el, s390x
 tcpdump | 4.9.2-0ubuntu0.14.04.1 | trusty-security | source, amd64, arm64, armhf, i386, powerpc, ppc64el
 tcpdump | 4.9.2-0ubuntu0.14.04.1 | trusty-updates | source, amd64, arm64, armhf, i386, powerpc, ppc64el
 tcpdump | 4.9.2-3 | bionic | source, amd64, arm64, armhf, i386, ppc64el, s390x
 tcpdump | 4.9.3-0ubuntu0.16.04.1 | xenial-security | source, amd64, arm64, armhf, i386, powerpc, ppc64el, s390x
 tcpdump | 4.9.3-0ubuntu0.16.04.1 | xenial-updates | source, amd64, arm64, armhf, i386, powerpc, ppc64el, s390x
 tcpdump | 4.9.3-0ubuntu0.18.04.2 | bionic-security | source, amd64, arm64, armhf, i386, ppc64el, s390x
 tcpdump | 4.9.3-0ubuntu0.18.04.2 | bionic-updates | source, amd64, arm64, armhf, i386, ppc64el, s390x
 tcpdump | 4.9.3-4 | focal | source, amd64, arm64, armhf, ppc64el, riscv64, s390x
 tcpdump | 4.9.3-4ubuntu0.1 | focal-security | source, amd64, arm64, armhf, ppc64el, riscv64, s390x
 tcpdump | 4.9.3-4ubuntu0.1 | focal-updates | source, amd64, arm64, armhf, ppc64el, riscv64, s390x
 tcpdump | 4.99.1-3build2 | jammy | source, amd64, arm64, armhf, ppc64el, riscv64, s390x
 tcpdump | 4.99.1-4 | kinetic | source, amd64, arm64, armhf, ppc64el, riscv64, s390x

Marking Fix Released.