NAME¶

scado - Script Capability Ambient DO

SYNOPSIS¶

scado -D | -e | -l
scado -u command | -U
scado -h

DESCRIPTION¶

cado(1) allows the system administrator to delegate capabilities to users. Users can grant a subset of these ambient capabilities to trusted programs. Each user can define their own list of trusted programs and which capabilities to grant, using a scado file. cado -S or cado --scado run those trusted programs without any further authentication. In this way it is also possible to run programs requiring specific capabilities within a bash script.

Scado is the command a user can run to create, edit, check or delete their own scado file.

Each line of a scado file file has the following syntax:

The path_of_the_executable_file must be absolute.

The capability_list is a comma separated list of capability names or capability masks. For brevity, the cap_ prefix of capabilities names can be omitted (e.g. net_admin and cap_net_admin have the same meaning).

The sha256_digest_of_the_executable prevents TOCTTOU attacks. When a user wants to run the file at path_of_the_executable_file granting it some of the capabilities in the capability_list, the permission is denied if its sha256 digest does not match sha256_digest_of_the_executable.

If there are only two colon (:) separated fields in a line, it means that the user trusts a priori the integrity of the file whose pathname is path_of_the_executable_file. It can be, for example, a program in /bin or /usr/bin not modifiable by users.

If there are three fields (i.e. two colon characters), it means that the user wants the cryptographic digest check on the executable file integrity. When a user edits their scado file, if the field (sha256_digest_of_the_executable) is empty, scado computes it automatically when the scado file is saved.

Scado asks for user authentication by PAM to confirm any modification of the scado file.

There is also a TOCTTOU protection at running time: cado -S copies the executable file in a safe place, where the user cannot change it, and runs it only if the integrity check on it succeeds. The user (or a malicious intruder acting as the user) cannot modify the file after the integrity check has completed and before the program is loaded.

OPTIONS¶

scado accepts the following options:

-l

--list

Display the current scado file. The actual file in the file system is not accessible by unprivileged users, for security reasons.

-e

--edit

Edit the scado file of the current user using the editor specified by either the VISUAL or the EDITOR environment variable (checked in that order). After you exit from the editor, the modified file will be installed automatically.

-D

--delete

Delete the current user's scado file.

-u command

--update command

Recompute the hash of the line which starts with command.

-U

--update-all

Update all the digest entries.

-h

--help

print a short usage banner and exit.

EXCEPTIONS FILES EXAMPLES¶

Allow cado -S to run /bin/ping providing it with the cap_net_raw capability, without any integrity check:

Allow the activation of ping with cap_net_raw provided it has a specific SHA256 digest

Compute the SHA256 digest of (the current version of) ping so, allow the activation of ping with cap_net_raw provided it has not been modified.

If one of the example lines here above has been inserted in the user scado file using scado -e, it is possible to execute ping as follows:

SEE ALSO¶

cado(1), capabilities(7)