/etc
/etc/apparmor.d
/etc/apparmor.d/usr.bin.tcpdump