Why cannot I write to /dev/stdout? I am logged in as the root user, what greater permission could I have?

root@ubuntu:/# tcpdump -i 2 -w /dev/stdout
tcpdump: /dev/stdout: Permission denied

The above command with -w /dev/null works. I am using stock Ubuntu Linux.

Now, stdout redirects to proc which redirects to /dev/pts, which is a char dev and has w permission -- what else is there?

crw-rw-rw- 1 root root 1, 3 2013-08-26 00:29 /dev/null
lrwxrwxrwx 1 root root   15 2013-08-26 00:29 /dev/stdout -> /proc/self/fd/1
lrwx------ 1 root root   64 2013-08-26 10:10 /proc/self/fd/1 -> /dev/pts/0
crw--w---- 1 xxx  tty  136, 0 2013-08-26 10:11 /dev/pts/0
root@ubuntu:/# tcpdump -i 2 -w /dev/pts/0
tcpdump: /dev/pts/0: Permission denied

I would imagine that was apparmor denying that open operation. Do you get something similar to below in your syslog?

kernel: [14124112.152452] type=1400 audit(1377537799.840:40): apparmor="DENIED" operation="open" parent=111 profile="/usr/sbin/tcpdump" name="/dev/pts/0" pid=222 comm="tcpdump" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0

By default tcpdump (without -w) passes output to stdout anyway - are you trying to get the replay data on stdout? In which case you can use -w - instead of -w /dev/stdout?

If you want to use /dev/stdout, and specifically /dev/pts/* via apparmor, edit /etc/apparmor.d/usr.sbin.tcpdump and add an entry:

/dev/pts/* rw,

and then reload the profile:

apparmor_parser -r /etc/apparmor.d/usr.sbin.tcpdump

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.