23
[root@localhost ~]# cat /etc/issue
Fedora release 17 (Beefy Miracle)
Kernel \r on an \m (\l)
[root@localhost ~]# uname -a
Linux localhost.localdomain 3.6.10-2.fc17.i686 #1 SMP Tue Dec 11 18:33:15 UTC 2012 i686 i686 i386 GNU/Linux
[root@localhost ~]# tcpdump -i p3p1 -n -w out.pcap -C 16
tcpdump: out.pcap: Permission denied

Why I get error??

What should I do?

7 Answers 7

30

i tried on Centos 5, still the same even on tmp or root folder. from the tcpdump man page, privileges are dropped when used with -Z option (enabled by default) before opening first savefile. because you specified "-C 1", the permission denied occur because of the file size already reached 1, and when create new file it will raise an permission denied error. so just specify the -Z user

# strace tcpdump -i eth0 -n -w out.pcap -C 1
fstat(4, {st_mode=S_IFREG|0644, st_size=903, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aea31934000
lseek(4, 0, SEEK_CUR)                   = 0
read(4, "root:x:0:root\nbin:x:1:root,bin,d"..., 4096) = 903
read(4, "", 4096)                       = 0
close(4)                                = 0
munmap(0x2aea31934000, 4096)            = 0
setgroups(1, [77])                      = 0
setgid(77)                              = 0
setuid(77)                              = 0
setsockopt(3, SOL_SOCKET, SO_ATTACH_FILTER, "\1\0\0\0\0\0\0\0\310\357k\0\0\0\0\0", 16) = 0
fcntl(3, F_GETFL)                       = 0x2 (flags O_RDWR)
fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK)    = 0

recvfrom(3, 0x7fff9563d35f, 1, 32, 0, 0) = -1 EAGAIN (Resource temporarily unavailable)
fcntl(3, F_SETFL, O_RDWR)               = 0
setsockopt(3, SOL_SOCKET, SO_ATTACH_FILTER, "\1\0\17\0\0\0\0\0P\327\233\7\0\0\0\0", 16) = 0
open("out.pcap", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EACCES (Permission denied)
write(2, "tcpdump: ", 9tcpdump: )                = 9
write(2, "out.pcap: Permission denied", 27out.pcap: Permission denied) = 27
write(2, "\n", 1
)                       = 1
exit_group(1)                           = ?

you can see the strace result above, tcpdump dropped the privileges into user and group pcap (77).

# grep 77 /etc/group
pcap:x:77:
# grep 77 /etc/passwd
pcap:x:77:77::/var/arpwatch:/sbin/nologin

From tcpdump man page, -C

# man tcpdump
       -C     Before writing a raw packet to a savefile, check whether the file is currently larger than file_size and, if so,
              close the current savefile and open a new one.  Savefiles after the first savefile will have the name  specified
              with  the -w flag, with a number after it, starting at 1 and continuing upward.  The units of file_size are mil-
              lions of bytes (1,000,000 bytes, not 1,048,576 bytes).

              **Note that when used with -Z option (enabled by default), privileges are dropped before opening first savefile.**


# tcpdump --help
tcpdump version 3.9.4
libpcap version 0.9.4
Usage: tcpdump [-aAdDeflLnNOpqRStuUvxX] [-c count] [ -C file_size ]
                [ -E algo:secret ] [ -F file ] [ -i interface ] [ -M secret ]
                [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
                [ -W filecount ] [ -y datalinktype ] [ -Z user ]
                [ expression ]

Specify specific user with -Z user

# tcpdump -i eth0 -n -w out.pcap -C 1 -Z root
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
35 packets captured
35 packets received by filter
0 packets dropped by kernel     
0
17

When I ran into this Permission denied issue it turned out to be that I was putting a .cap extension on the file instead of .pcap. As RichL pointed out in the comments, AppArmor profile on Ubuntu /etc/apparmor.d/usr.sbin.tcpdump causes this.

  # uname -a ; lsb_release -a
  Linux bidder-lb4 3.2.0-76-virtual #111-Ubuntu SMP Tue Jan 13 22:33:42 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
  No LSB modules are available.
  Distributor ID: Ubuntu
  Description:    Ubuntu 12.04.5 LTS
  Release:        12.04
  Codename:       precise
3
  • 7
    It turns out the AppArmor profile for Ubuntu (/etc/apparmor.d/usr.sbin.tcpdump) only allows the tcpdump binary to write to files with a .pcap extension. AppArmor is on by default in Ubuntu, which caught me out.
    – Rich L
    Dec 3, 2015 at 16:05
  • 1
    Thank you, kind man! I've had hard time trying to get why is changing extension of the output file gives a permission denied error. And when you move to the home directory, dependency on the extension suddenly disappears.
    – trolzen
    Jul 27, 2021 at 12:01
  • 2
    @RichL For me, I was able to write to packet.dump on ubuntu 20.04, but I was not able to read from it until I changed the extension. 🤦‍♂️
    – weberc2
    Nov 11, 2021 at 0:58
9

Try to run the command from /tmp or any other world writable directory. I remember having issues with tcpdump in directories which are not world writable, I have no clue why -:)

         cd /tmp
         tcpdump -i p3p1 -n -w out.pcap -C 16 
7

Your tcpdump is dropping privileges to the 'tcpdump' user, check the man page ("-Z tcpdump" is the default, and the tcpdump user doesn't have permissions to write in root's homedir). As Daniel T. told you, run your capture in a world-writable directory like /tmp, or at least a directory where you've given either the user or group 'tcpdump' write permissions.

3

Is SELinux running? Check by typing is terminal:

/usr/sbin/getenforce

If it says Enforcing, you can try disabling SELinux and trying the tcpdump again, to see if SE was stopping it.

1
  • @Hauke Laging From his bash output, it seems he is running the command from root's home dir. Feb 14, 2013 at 2:48
1

The error message doesn't make much sense to me. SELinux is a possible explanation, though. You may have a closer look at what's happening by starting tcpdump through strace:

strace tcpdump -i p3p1 -n -w out.pcap -C 16
1

you should change the mode of directory under which you are running tcpdump .

chmod 777

Now run the command tcpdump -vv -i any -s0 -w file_name.pcap

It should work ...!!

1
  • 1
    For certain values of 'work'. You now have a directory which includes the packet capture which may well contain exposed sensitive data within, readable by anyone with access to the host. "Hey doctor, I have a hangnail" should not be answered with amputation, no matter how completely that solves the hangnail problem.
    – DopeGhoti
    Feb 23, 2018 at 17:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .