Q: How do I grant permissions to /dev/video* and /dev/snd/* to a second user, user2 when logged in interactively as user1?
I have written a wrapper for sudo that clones the XAuthority settings, and allows me to run desktop commands as a different user. The working part of it is simply running sudo with the supplied parameters:
sudo -u user2 $somecommand
However, user2 cannot use the sound or video devices, since udev has only granted them to the logged in user user1. It is possible to grant these permissions after the fact with one of these commands:
sudo setfacl -m group:user2:rwx /dev/video0 /dev/snd/* sudo setfacl -m user:user2:rwx /dev/video0 /dev/snd/*
This code has to be run every session, but I would like these permissions to be granted to both user1 and user2 when user1 starts new display manager session.
The application for this is to run somewhat untrusted programs such as browser, chat client, mail agent, and voip and webcam clients as separate users, while still allowing those programs to access the desktop and the video and sound devices. I continually end up running skype chat without sound and video capabilities :(