tcpdump can't gzip files

Bug #844212 reported by Nick Semenkovich
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
apparmor (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

With apparmor set to enforce tcpdump policy, tcpdump won't work as according to the manpages:

From the manpages:
"""
-z Used in conjunction with the -C or -G options, this will make tcpdump run " command file " where file is the savefile being closed after each rotation. For example, specifying -z gzip or -z bzip2 will compress each savefile using gzip or bzip2.

Note that tcpdump will run the command in parallel to the capture, using the lowest priority so that this doesn't disturb the capture process.
"""

Example command:
/usr/sbin/tcpdump -i eth0 -n -W 1 -G 1 -z gzip -w %m-%d-%y-%H:%S.pcap

Log:
Sep 7 13:40:01 some-machine kernel: [451148.079904] type=1400 audit(1315420801.653:51): apparmor="DENIED" operation="mknod" parent=16389 profile="/usr/sbin/tcpdump" name="/path/09-07-11-12:00.pcap.gz" pid=21549 comm="gzip" requested_mask="c" denied_mask="c" fsuid=0 ouid=0

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Thank you for taking the time to report this bug and helping to make Ubuntu better. This particular bug has already been reported and is a duplicate of bug 722856, so it is being marked as such. Please look at the other bug report to see if there is any missing information that you can provide, or to see if there is a workaround for the bug. Additionally, any further discussion regarding the bug should occur in the other report. Please continue to report any other bugs you may find.

Changed in apparmor (Ubuntu):
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.