SCADO(1)

💖 NAME 💖

scado — Script Capability Ambient DO (yes bestie, that's the whole name, it's giving Very Serious Acronym Energy 💅)

---

✨ SYNOPSIS ✨

scado -D | -e | -l
scado -u command | -U
scado -h

Three little modes, pick your fighter 🌸

---

🦋 DESCRIPTION 🦋

Okay so first things first: cado(1) is the whole system that lets your sysadmin delegate capabilities to users. And you, a humble user, get to hand out a subset of those ambient capabilities to programs you trust. Every user gets to write their own personal list of trusted programs + which capabilities they get, and that list lives in a scado file. Then cado -S or cado --scado runs those trusted programs with no further authentication. Slay. And because of that, you can even run programs that need specific capabilities from inside a bash script. Iconic behavior, honestly.

So scado is the command you run to create, edit, check, or delete your very own scado file. It's your file, your rules (within the rules) 🫶

---

Each line of a scado file has this syntax:

path_of_the_executable_file : capability_list

or

path_of_the_executable_file : capability_list :
sha256_digest_of_the_executable

Peep the EXAMPLES section at the end of this man page for more info, bestie. Also: everything on a line after a # sign is a comment — trailing comments, whole-line comments, all of it. ✨

The path_of_the_executable_file must be absolute. No relative paths, no shortcuts, absolute or nothing.

The capability_list is a comma separated list of capability names or capability masks. And for brevity — because typing is hard and life is short — the cap_ prefix can be omitted (e.g. net_admin and cap_net_admin mean the exact same thing 💅).

The sha256_digest_of_the_executable is the anti-TOCTTOU defense. Here's the vibe: when you want to run the file at path_of_the_executable_file granting it some of the capabilities in the capability_list, the permission is denied if its sha256 digest does not match sha256_digest_of_the_executable. No match, no run, periodt.

If there are only two colon (:) separated fields on a line, that means you trust the integrity of that file a priori. That's for stuff like a program in /bin or /usr/bin that users can't modify anyway. Chill, no digest needed.

If there are three fields (i.e. two colon characters), that means you do want the cryptographic digest check on the executable's integrity. And here's the cute part: when you edit your scado file and the sha256_digest_of_the_executable field is empty, scado computes it automatically when the scado file is saved. It literally does the math for you 🧚

Scado asks for user authentication by PAM to confirm any modification of the scado file. So yes, it's checking that it's really you before it touches anything.

There's also a TOCTTOU protection at running time: cado -S copies the executable file into a safe place where the user can't change it, and runs it only if the integrity check on it succeeds. So the user (or a malicious intruder acting as the user 😭) cannot modify the file after the integrity check has completed and before the program is loaded. Race condition? Not today. 💀

---

🎀 OPTIONS 🎀

scado accepts the following options:

• -l, --list — Display the current scado file. Note: the actual file in the file system is not accessible by unprivileged users, for security reasons. So this is your peek behind the curtain 👀
• -e, --edit — Edit the scado file of the current user using the editor specified by either the VISUAL or the EDITOR environment variable (checked in that order, bestie — VISUAL first, then EDITOR). After you exit from the editor, the modified file will be installed automatically. ✨
• -D, --delete — Delete the current user's scado file. Gone. Poof. 🦋
• *-u *command, --update command — Recompute the hash of the line which starts with command.
• -U, --update-all — Update all the digest entries. All of them. Every single one. 👑
• -h, --help — print a short usage banner and exit.

---

🌈 EXCEPTIONS FILES EXAMPLES 🌈

Let's get concrete, bestie.

Example one — allow cado -S to run /bin/ping providing it with the cap_net_raw capability, without any integrity check:

/bin/ping : cap_net_raw

Example two — allow the activation of ping with cap_net_raw provided it has a specific SHA256 digest:

/bin/ping : cap_net_raw :
dcb237f1cb20ee7b1550900d1b524c554063fd17fc673c56d341736ced6bed4b

Example three — compute the SHA256 digest of (the current version of) ping so, allow the activation of ping with cap_net_raw provided it has not been modified:

/bin/ping : cap_net_raw :

(See that empty digest field? That's the auto-compute-on-save situation from up above. It's giving self-sufficient 🧚)

And if one of the example lines here above has been inserted in the user scado file using scado -e, it is possible to execute ping as follows:

cado -S cap_net_raw /bin/ping

That's the whole loop, bestie. Write it, hash it, run it. 💅

---

💜 SEE ALSO 💜

• cado(1)
• capabilities(7)

---

Okay that's the whole page!! Written by the absolute legends at VirtualSquare Labs, dated June 23, 2016. Go forth and manage your capabilities responsibly, queen 👑✨💖