# Capturing system calls with /dev/scap*

On Debian the scap kernel module is installed with access permissions
for the "scap" group. Members of the "scap" group will be able to read
and write /dev/scap* and capture system calls.

Note that no users will be added to the "scap" group automatically; a
system administrator has to add them manually, using the usermod command:

   sudo usermod -a -G scap {username}

or, if you're using a desktop environment that includes a tool for
managing users, such as the "Users and Groups" tool in GNOME (found in
the gnome-system-tools package), using that tool.  After a user is added
to the scap group, they may need to log in again to make make their new
group membership take effect and be able to capture packets.
