---
name: "cado.conf"
section: "5"
platform: "linux"
package: "cado"
version: "0.9.6-1+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/cado.conf"
---

# cado.conf(5)

Capability Ambient DO: configuration file

## NAME

cado.conf - Capability Ambient DO: configuration file

## DESCRIPTION

The **/etc/cado.conf** file is used to configure which ambient cabalities can be provided by **cado** to users. **cado** uses the capability cap\_dac\_read\_search to access **/etc/cado.conf**, so this configuration does not need to be readable by users.

All lines beginning with the sign '#' are comments.

Non-comment lines have the following syntax

```
       list_of_capabilities: list_of_users_and_groups
```

or

```
       list_of_capabilities: list_of_users_and_groups: list_of_auth_commands
```

Both *list\_of\_capabilities* and *list\_of\_users\_and\_groups* are comma separated lists of identifiers.

Items of *list\_of\_capabilities* are capability names or capability masks (exadecimal numbers). For brevity, the **cap\_** prefix of capability names can be omitted (e.g. **net\_admin** and **cap\_net\_admin** have the same meaning).

Items of *list\_of\_users\_and\_groups* are usernames or groupnames (groupnames must be prefexed by '@').

*list\_of\_auth\_commands* is a command or a list of commands separated by semicolon (;). If present, cado runs all the sequence of commands it grants the capabilities as defined in the current line only if all return zero as their exit status.

Example of **cado.conf** file:

```
	# Capability Ambient DO configuration file
	# cado.conf
	net_admin: @netadmin,renzo: /usr/bin/logger cado net_admin $USER; /bin/echo OK
	net_admin: @privatenet: /usr/local/lib/cado_autorize_privatenet
	net_admin,net_bind_service,net_raw,net_broadcast: @vxvdex
	cap_kill: renzo
```

In this example the renzo's processes can be granted (by **cado**) cap\_net\_admin and cap\_kill. cap\_net\_admin can be acquired by processes owned by users belonging to the netadmin group. Users in vxvdex can provide their processes with a subset of cap\_net\_admin, cap\_net\_bind\_service, cap\_net\_raw and cap\_net\_broadcast

## SEE ALSO

[**cado**(1)](/cado/1.md), [**caprint**(1)](/caprint/1.md), [**capabilities**(7)](/capabilities/7.md)