"Permission denied" when writing to /dev/stdout

Question

Why cannot I write to /dev/stdout? I am logged in as the root user, what greater permission could I have?

root@ubuntu:/# tcpdump -i 2 -w /dev/stdout
tcpdump: /dev/stdout: Permission denied

The above command with -w /dev/null works. I am using stock Ubuntu Linux.

Now, stdout redirects to proc which redirects to /dev/pts, which is a char dev and has w permission -- what else is there?

crw-rw-rw- 1 root root 1, 3 2013-08-26 00:29 /dev/null
lrwxrwxrwx 1 root root   15 2013-08-26 00:29 /dev/stdout -> /proc/self/fd/1
lrwx------ 1 root root   64 2013-08-26 10:10 /proc/self/fd/1 -> /dev/pts/0
crw--w---- 1 xxx  tty  136, 0 2013-08-26 10:11 /dev/pts/0
root@ubuntu:/# tcpdump -i 2 -w /dev/pts/0
tcpdump: /dev/pts/0: Permission denied

Answer 1

I would imagine that was apparmor denying that open operation. Do you get something similar to below in your syslog?

kernel: [14124112.152452] type=1400 audit(1377537799.840:40): apparmor="DENIED" operation="open" parent=111 profile="/usr/sbin/tcpdump" name="/dev/pts/0" pid=222 comm="tcpdump" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0

By default tcpdump (without -w) passes output to stdout anyway - are you trying to get the replay data on stdout? In which case you can use -w - instead of -w /dev/stdout?

If you want to use /dev/stdout, and specifically /dev/pts/* via apparmor, edit /etc/apparmor.d/usr.sbin.tcpdump and add an entry:

/dev/pts/* rw,

and then reload the profile:

apparmor_parser -r /etc/apparmor.d/usr.sbin.tcpdump