3

Q: How do I grant permissions to /dev/video* and /dev/snd/* to a second user, user2 when logged in interactively as user1?

I have written a wrapper for sudo that clones the XAuthority settings, and allows me to run desktop commands as a different user. The working part of it is simply running sudo with the supplied parameters:

sudo -u user2 $somecommand

However, user2 cannot use the sound or video devices, since udev has only granted them to the logged in user user1. It is possible to grant these permissions after the fact with one of these commands:

sudo setfacl -m group:user2:rwx /dev/video0 /dev/snd/*
sudo setfacl -m user:user2:rwx /dev/video0 /dev/snd/*

This code has to be run every session, but I would like these permissions to be granted to both user1 and user2 when user1 starts new display manager session.

The application for this is to run somewhat untrusted programs such as browser, chat client, mail agent, and voip and webcam clients as separate users, while still allowing those programs to access the desktop and the video and sound devices. I continually end up running skype chat without sound and video capabilities :(

  • This should be handled via policykit. What distribution are you using? Are you logging in via a display manager? – Gilles 'SO- stop being evil' Mar 17 '14 at 20:47
0

The solution to this problem should be sudo, too.

You put these commands in a file which only root can modify or replace and allow both users to execute it as root without password.In the startup scripts you make this sudo call then.

| improve this answer | |
  • This solution seems more like the right thing™ to do, since setting up sudo to allow one user to become another will require root access anyhow. It also allows the scheme to rely on one security tool instead of two... – Des Cent Mar 26 '14 at 13:00
0

Why don't you simply add both user1 and user2 to the "video" and "audio" groups?

This of course assumes that your linux is set up so that "is member of group video" implies "can access video devices". If the group and group permissions of /dev/video* and /dev/audio* fit, that should work...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.