CADO(1)

💖 CADO — Capability Ambient DO 💖

okay bestie, gather round, because cado is genuinely one of those little tools that's lowkey iconic once you get it. it lives in the General Commands Manual section, so let's get into it. 🦋

✨ SYNOPSIS ✨

cado [ OPTIONS ] capability_list [ command [ args ] ]

🌸 DESCRIPTION 🌸

so, what is cado? bestie, it lets the system administrator delegate capabilities to users. it's literally a capability based sudo. 👑

like, sudo lets authorized users run programs as root (or as another user), but cado lets authorized users run programs with specific (ambient) capabilities instead. so much more selective, fr fr. users can be authorized to have only specific capabilities — and not others. the way that it doesn't just hand out root like candy? obsessed. 💅

capability_list is a comma separated list of capability names or capability masks (exadecimal numbers). and for brevity, the cap_ prefix of capability names can be omitted — so net_admin and cap_net_admin have the same meaning. no cap. 🧚

if it's allowed for the current user to run processes with the requested capabilities, the user is asked to type their password (or to authenticate themselves as required by pam — unless you're in -S or --scado mode). once the authentication succeeds, cado executes the command granting the required ambient capabilities. slay. ✨

if command is omitted, cado launches the command specified in the environment variable $SHELL. 🌈

the file /etc/cado.conf (peep cado.conf(5)) defines which capabilities can be provided by cado to each user. and here's the important bit: cado itself is not a setuid executable — it uses the capability mechanism and it has an option to set its own capabilities. so after each change in the /etc/cado.conf, the capability set should be recomputed by root using the command cado -s or cado --setcap. don't forget this step bestie, it matters. 🎀

now, when cado runs in scado mode (via the option -S or --scado), if

• the current user is allowed to run processes with the requested capabilities,
• the command argument is an absolute pathname and
• there is a specific authorization line in the user's scado file,

then cado runs the command granting the required ambient capabilities without any further authentication request — it does not prompt for a password. no password moment, we love that for you. 🔥

👑 OPTIONS 👑

cado accepts the following options:

• -v, --verbose — run in verbose mode. cado shows the set of allowed capabilities, requested cababilities, unavailable capabilities and (in case of -s) the set of capabilities assigned to cado.conf itself. very main character of it to show its whole thought process. 💜
• -f, --force — do not fail in case the user asks for unavailable capabilities; cado in this case grants the intersection between the set of requested cababilities and the set of allowed capabilities. so you get what you get and you don't throw a fit. 🍓
• -s, --setcap — cado computes the miminal set of capability required by itself and sets the file capability of the cado executable. this is the root-only recompute step we mentioned, don't skip it. 💅
• -S, --scado — launch cado with scado(1) support. command must be an absolute pathname and a specific authorization line must appear in the user's scado file. 📌
• -h, --help — print a short usage banner and exit.

💀 SEE ALSO 💀

cado.conf(5), caprint(1), scado(1), capabilities(7)

okay that's the whole vibe. go forth and delegate capabilities responsibly, bestie 🫶

this iconic little page comes to you from VirtualSquare Labs, dated June 23, 2016 — and it's literally listed as CADO(1) up top. periodt. 💖✨