tcpdump can't open file: permission denied (linux)
You're probably in a directory that can't be written to, such as /proc, or an NFS mounted directory with root_squash. Change to a writable directory and try again, or direct your output file to a writable directory.
This is an apparmor bug. It supposedly works in /tmp and /root, but not for me. A workaround is to run it with a specific apparmor profile:
aa-exec -p unconfined tcpdump -w file.pcap