I have a user that I use to run untrusted programs (more specifically, Skype). I would like to give that user access to the webcam.
I am using Debian, where the standard way to do this is to put users in the
video group. However, it seems like this allows them to do more than just access the webcam, more specifically they can "write to video memory" https://www.debian-administration.org/article/109/How_Debian_controls_hardware_access. I am not sure about the security implications of this.
What is the proper way to give a user access specifically to the webcam? I could change the ownership of
/dev/video0 to a specific group that I would put the restricted user and my regular user in, but is this the correct way, and is there a proper way to make it persist across reboots? Alternatively, I have heard that this was doable with PolicyKit or ConsoleKit, but I have been unable to find examples online. How can this be done then?
To give more details: the unprivileged user will never use a TTY or a GDM to log in. It runs its applications using sudo launched by my regular user, and accesses my regular user's pulseaudio daemon and my regular user's X server (via xpra).
Thanks a lot in advance for your help!