The `video` group mixes permissions for video output and input devices
TLDR: when a user is made a member of the
video group in order to have access to webcam devices, that user and all their processes also have unrestricted access to raw video output device nodes.
I have reported this upstream to
eudev too, but I wouldn't count on this being fixed soon.
Wayland compositors use something like
elogind to access video output hardware and input devices (mouse, keyboards, etc). This means that they don't need access to the hardware device itself. The recommendation from upstream (e.g.: developers of compositors and tools like
seatd) is that users don't need to be a member of the
video group. This prevents other user processes from having unrestricted access to the video output device.
If a user account can't access the device nodes, then neither can the processes or sandboxes that this user spawn.
Currently on Alpine, the
video group has two purposes:
- Granting access to video output devices (e.g.:
- Granting access to video input devices such as webcams.
If I want an account to have access to a webcam, it also immediately gets access to the hardware rendering device (and can, for example, screen-record what other users are doing, screen-spoof, etc).
I think that the correct fix for this is:
- Keep using the
videogroup for video output devices (this minimises breakage for existing installations).
- Use the
cameragroup for webcams and other video input devices.
This requires patching several
udev rules, both from
eudev itself and third party rules.
This is a breaking change, and should be announced as such (it requires user intervention in most scenarios which make use of this group). I think that this specific approach is the least-breaking one, since it won't break existing Alpine installations which actually do require direct access to video hardware.
Sadly, this might spawn a wave of "my webcam stopped working" questions on IRC.
Before sending out patches, I'd like to hear what others think about this. This issue affects both Alpine and upstream, so this might need to be a coordinated effort).