Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For inconvenient reasons going beyond the scope of this question, I have to run tcpdump from within a Python script. I currently just call subprocess.Popen(['tcpdump', ...) and everything works just fine. However, when I use tools like pyInstaller to package the script into an executable, and run it (as root), I get the following error:

tcpdump: error while loading shared libraries: libcrypto.so.0.9.8: "failed to map segment from shared object: Permission denied" 

As I found out, this is AppArmor whining. Now, I can easily replace my call to tcpdump with the following:

subprocess.call(['aa-complain', '/usr/sbin/tcpdump'])
pcap = subprocess.Popen(['tcpdump', ...)
subprocess.call(['aa-enforce', '/usr/sbin/tcpdump'])

Now it prints two info lines (about changing into complain/enforce mode), and runs tcpdump without further complaints.

The people who will run this script will run it as root when they want to do packet captures, so I don't see how this is a security problem. At the same time, the above seems hackish to me. So to the AppArmor experts among you: is this the canonical way to deal with it?

PS. I'm also thankful for links to a good, quick introduction to AppArmor in general, since this is the first time I'm encountering this.

share|improve this question

Well this should be a start, if you haven't already browsed it: https://help.ubuntu.com/community/AppArmor

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.