為了定位問題，需要在Linux上使用tcpdump並且保存到文件，遇到了如下問題：
tcpdump port 9001 -w xx
tcpdump: xx: Permission denied
因為已經是root用戶，所以判斷不是文件系統權限的問題。
在網上查了一下，找到解決方法：將tcpdump的模式從enforce改為complain模式。
修改過程如下：
先查看處在那個模式：
grep tcpdump /sys/kernel/security/apparmor/profiles
/usr/sbin/tcpdump (enforce)
果然不是complain模式。
修改為complain模式：
aa-complain /usr/sbin/tcpdump
The program 'aa-complain' is currently not installed. You can install it by typing:
apt-get install apparmor-utils
出現錯誤，按照提示安裝apparmor-utils，過程略，然後再次執行：
aa-complain /usr/sbin/tcpdump
Setting /usr/sbin/tcpdump to complain mode.
查看：
grep tcpdump /sys/kernel/security/apparmor/profiles
/usr/sbin/tcpdump (complain)
完成
參考：
tcpdump permission denied：https://ubuntuforums.org/showthread.php?t=1501339
頁面內容比較多，關鍵信息如下：
This is probably caused by AppArmor. You need to switch from 'enforcement' mode to 'complain' mode on 'tcpdump'. Run the following command as root:
Code:
aa-complain /usr/sbin/tcpdump
You can check by running the following command as root:
Code:
grep tcpdump /sys/kernel/security/apparmor/profiles
You should see (enforce) or (complain). You want it to say (complain).
AppArmor介紹：http://www.tuicool.com/articles/aeiIzq
Linux版本：Linux 10-6-13-14 3.2.0-85-generic #122-Ubuntu SMP Tue May 26 16:14:57 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
http://xxxxxx/Linuxjc/1145358.html TechArticle