NAME

       cado.conf - Capability Ambient DO: configuration file

DESCRIPTION

       The  /etc/cado.conf  file is used to configure which ambient cabalities can be provided by cado to users.
       cado uses the capability cap_dac_read_search to access /etc/cado.conf, so  this  configuration  does  not
       need to be readable by users.

       All lines beginning with the sign '#' are comments.

       Non-comment lines have the following syntax
              list_of_capabilities: list_of_users_and_groups
       or
              list_of_capabilities: list_of_users_and_groups: list_of_auth_commands

       Both list_of_capabilities and list_of_users_and_groups are comma separated lists of identifiers.

       Items  of  list_of_capabilities  are  capability  names  or  capability  masks (exadecimal numbers).  For
       brevity, the cap_ prefix of capability names can be omitted (e.g. net_admin and  cap_net_admin  have  the
       same meaning).

       Items of list_of_users_and_groups are usernames or groupnames (groupnames must be prefexed by '@').

       list_of_auth_commands  is  a  command  or a list of commands separated by semicolon (;). If present, cado
       runs all the sequence of commands it grants the capabilities as defined in the current line only  if  all
       return zero as their exit status.

       Example of cado.conf file:

            # Capability Ambient DO configuration file
            # cado.conf

            net_admin: @netadmin,renzo: /usr/bin/logger cado net_admin $USER; /bin/echo OK
            net_admin: @privatenet: /usr/local/lib/cado_autorize_privatenet
            net_admin,net_bind_service,net_raw,net_broadcast: @vxvdex
            cap_kill: renzo

       In this example the renzo's processes can be granted (by cado) cap_net_admin and cap_kill.  cap_net_admin
       can be acquired by processes owned by users belonging to the netadmin group.  Users in vxvdex can provide
       their processes with a subset of cap_net_admin, cap_net_bind_service, cap_net_raw and cap_net_broadcast

SEE ALSO

       cado(1), caprint(1), capabilities(7)