AppArmor provides /etc/apparmor.d/local/ for rules to add to the main ones. (Although this can't be used to override an explicit deny like tcpdump's ban on using files in $HOME/bin.) We just need to add a rule for the *.gz, and while we're there, why not the *.bz2 version as well?
/**.[pP][cC][aA][pP].[gG][zZ] rw,
/**.[pP][cC][aA][pP].[bB][zZ]2 rw,
The trailing comma does not seem to be an issue for me. Note also that we don't need to specify the binary and braces, since the #include line in the system profile is already inside the braces.
Ubuntu ships some files in the local directory already; we should be able to run
sudo -e /etc/apparmor.d/local/usr.sbin.tcpdump
and add the lines above to the existing file. Once the file is ready, we need to reload that profile to the kernel. Note that we use the system profile here, not the one we just edited:
sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.tcpdump
.
locate your core in usr/src/
use sudo commands and should be fine
