putting the following in /etc/apparmor.d/local/usr.bin.tcpdump works around the problem:
/**.[pP][cC][aA][pP][0-9]* rw, please adjust the packaged apparmor profile for stable and unstable to allow people to use the -C -W option. -- - Harald Welte <lafo...@gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)
