---
name: "scado"
section: "1"
platform: "linux"
package: "cado"
version: "0.9.6-1+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/scado"
---

# scado(1)

Script Capability Ambient DO

## NAME

scado - Script Capability Ambient DO

## SYNOPSIS

**scado** **-D** \| **-e** \| **-l**\
 **scado** **-u** *command* \| **-U**\
 **scado** **-h**

## DESCRIPTION

**[cado(1)](/cado/1.md)** allows the system administrator to delegate capabilities to users. Users can grant a subset of these ambient capabilities to trusted programs. Each user can define their own list of trusted programs and which capabilities to grant, using a scado file. **cado -S** or **cado --scado** run those trusted programs without any further authentication. In this way it is also possible to run programs requiring specific capabilities within a bash script.

**Scado** is the command a user can run to create, edit, check or delete their own scado file.

Each line of a scado file file has the following syntax:\

*path\_of\_the\_executable\_file : capability\_list*

or\

*path\_of\_the\_executable\_file : capability\_list : sha256\_digest\_of\_the\_executable*

(See the EXAMPLES section at the end of the man page for more info. All the trailing part of a line following a # sign is a comment.).

The *path\_of\_the\_executable\_file* must be absolute.

The *capability\_list* is a comma separated list of capability names or capability masks.  For brevity, the **cap\_** prefix of capabilities names can be omitted (e.g. **net\_admin** and **cap\_net\_admin** have the same meaning).

The *sha256\_digest\_of\_the\_executable* prevents *TOCTTOU* attacks. When a user wants to run the file at *path\_of\_the\_executable\_file* granting it some of the capabilities in the *capability\_list*, the permission is denied if its sha256 digest does not match *sha256\_digest\_of\_the\_executable*.

If there are only two colon (**:**) separated fields in a line, it means that the user trusts a priori the integrity of the file whose pathname is *path\_of\_the\_executable\_file*. It can be, for example, a program in /bin or /usr/bin not modifiable by users.

If there are three fields (i.e. two colon characters), it means that the user wants the cryptographic digest check on the executable file integrity. When a user edits their scado file, if the field (*sha256\_digest\_of\_the\_executable*) is empty, **scado**  computes it automatically when the scado file is saved.

**Scado** asks for user authentication by PAM to confirm any modification of the scado file.

There is also a *TOCTTOU* protection at running time: cado -S copies the executable file  in a safe place, where the user cannot change it, and runs it only if the integrity check on it succeeds. The user (or a malicious intruder acting as the user) cannot modify the file after the integrity check has completed and before the program is loaded.

## OPTIONS

*scado* accepts the following options:

- **-l** **--list**

  **Display the current scado file. The actual file in the file system is not accessible by unprivileged users, for security reasons.**

- **-e** **--edit**

  **Edit the scado file of the current user using the editor specified by either the** **VISUAL** or the **EDITOR** environment variable (checked in that order). After you exit from the editor, the modified file will be installed automatically.

- **-D** **--delete**

  **Delete the current user's scado file.**

- **-u** *command* **--update** *command*

  Recompute the hash of the line which starts with *command*.

- **-U** **--update-all**

  **Update all the digest entries.**

- **-h** **--help**

  **print a short usage banner and exit.**

## EXCEPTIONS FILES EXAMPLES

**Allow cado -S** to run /bin/ping providing it with the cap\_net\_raw capability, without any integrity check:

/bin/ping : cap\_net\_raw

Allow the activation of ping with cap\_net\_raw provided it has a specific SHA256 digest

/bin/ping : cap\_net\_raw : dcb237f1cb20ee7b1550900d1b524c554063fd17fc673c56d341736ced6bed4b

Compute the SHA256 digest of (the current version of) ping so, allow the activation of ping with cap\_net\_raw provided it has not been modified.

/bin/ping : cap\_net\_raw :

If one of the example lines here above has been inserted in the user scado file using **scado -e**, it is possible to execute ping as follows:

cado -S cap\_net\_raw /bin/ping

## SEE ALSO

[**cado**(1)](/cado/1.md), [**capabilities**(7)](/capabilities/7.md)