From ec88fcbfcb2a928bb543bdc0497946ff6fe840cc Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Sat, 6 Sep 2025 23:18:31 +0200
Subject: [PATCH] feat(abs): add the camera abstraction

---
 apparmor.d/abstractions/app/chromium          |  2 +-
 apparmor.d/abstractions/camera                | 35 +++++++++++++++++++
 apparmor.d/abstractions/common/app            |  2 +-
 apparmor.d/groups/browsers/epiphany           |  3 +-
 apparmor.d/groups/freedesktop/pipewire        |  2 +-
 .../groups/freedesktop/pipewire-media-session |  2 +-
 apparmor.d/groups/freedesktop/pulseaudio      |  3 +-
 apparmor.d/groups/freedesktop/wireplumber     |  3 +-
 apparmor.d/profiles-s-z/signal-desktop        |  1 +
 apparmor.d/profiles-s-z/vlc                   |  2 +-
 10 files changed, 44 insertions(+), 11 deletions(-)
 create mode 100644 apparmor.d/abstractions/camera

diff --git a/apparmor.d/abstractions/app/chromium b/apparmor.d/abstractions/app/chromium
index f08a096ca..725b57fca 100644
--- a/apparmor.d/abstractions/app/chromium
+++ b/apparmor.d/abstractions/app/chromium
@@ -30,6 +30,7 @@
   include <abstractions/bus/org.gnome.Mutter.IdleMonitor>
   include <abstractions/bus/org.gnome.SessionManager>
   include <abstractions/bus/org.kde.kwalletd>
+  include <abstractions/camera>
   include <abstractions/common/chromium>
   include <abstractions/dconf-write>
   include <abstractions/desktop>
@@ -44,7 +45,6 @@
   include <abstractions/uim>
   include <abstractions/user-download-strict>
   include <abstractions/user-read-strict>
-  include <abstractions/video>
 
   network inet dgram,
   network inet6 dgram,
diff --git a/apparmor.d/abstractions/camera b/apparmor.d/abstractions/camera
new file mode 100644
index 000000000..0f5cff363
--- /dev/null
+++ b/apparmor.d/abstractions/camera
@@ -0,0 +1,35 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Allows access to all cameras
+
+  abi <abi/4.0>,
+
+  # Allow detection of cameras. Leaks plugged in USB device info
+  @{sys}/bus/usb/devices/ r,
+  @{sys}/devices/@{pci}/usb@{int}/**/busnum r,
+  @{sys}/devices/@{pci}/usb@{int}/**/devnum r,
+  @{sys}/devices/@{pci}/usb@{int}/**/idProduct r,
+  @{sys}/devices/@{pci}/usb@{int}/**/idVendor r,
+  @{sys}/devices/@{pci}/usb@{int}/**/interface r,
+  @{sys}/devices/@{pci}/usb@{int}/**/modalias r,
+  @{sys}/devices/@{pci}/usb@{int}/**/speed r,
+
+  @{sys}/class/video4linux/ r,
+  @{sys}/devices/**/video4linux/** r,
+  @{sys}/devices/**/video4linux/video@{int}/ r,
+  @{sys}/devices/**/video4linux/video@{int}/uevent r,
+
+  @{run}/udev/data/+usb:* r,              # Identifies all USB devices
+  @{run}/udev/data/c81:@{int}  r,         # For video4linux
+
+  # VideoCore cameras (shared device with VideoCore/EGL)
+  /dev/vchiq rw,
+
+  # Access to video /dev devices
+  /dev/video@{int} rw,
+
+  include if exists <abstractions/camera.d>
+
+# vim:syntax=apparmor
diff --git a/apparmor.d/abstractions/common/app b/apparmor.d/abstractions/common/app
index 5072cadfd..d0b36188b 100644
--- a/apparmor.d/abstractions/common/app
+++ b/apparmor.d/abstractions/common/app
@@ -16,6 +16,7 @@
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.a11y>
+  include <abstractions/camera>
   include <abstractions/consoles>
   include <abstractions/cups-client>
   include <abstractions/desktop>
@@ -30,7 +31,6 @@
   include <abstractions/path>
   include <abstractions/sqlite>
   include <abstractions/ssl_certs>
-  include <abstractions/video>
 
   dbus bus=accessibility,
   dbus bus=session,
diff --git a/apparmor.d/groups/browsers/epiphany b/apparmor.d/groups/browsers/epiphany
index 86b293e8d..45a32868e 100644
--- a/apparmor.d/groups/browsers/epiphany
+++ b/apparmor.d/groups/browsers/epiphany
@@ -12,6 +12,7 @@ profile epiphany @{exec_path} flags=(attach_disconnected) {
   include <abstractions/audio-server>
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.GeoClue2>
+  include <abstractions/camera>
   include <abstractions/common/bwrap>
   include <abstractions/common/gnome>
   include <abstractions/gstreamer>
@@ -61,8 +62,6 @@ profile epiphany @{exec_path} flags=(attach_disconnected) {
 
   deny @{user_share_dirs}/gvfs-metadata/* r,
 
-  /dev/video@{int} rw,
-
   include if exists <local/epiphany>
 }
 
diff --git a/apparmor.d/groups/freedesktop/pipewire b/apparmor.d/groups/freedesktop/pipewire
index 02a370cdc..c8c89ac13 100644
--- a/apparmor.d/groups/freedesktop/pipewire
+++ b/apparmor.d/groups/freedesktop/pipewire
@@ -14,8 +14,8 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.RealtimeKit1>
+  include <abstractions/camera>
   include <abstractions/nameservice-strict>
-  include <abstractions/video>
 
   capability sys_ptrace,
 
diff --git a/apparmor.d/groups/freedesktop/pipewire-media-session b/apparmor.d/groups/freedesktop/pipewire-media-session
index af6f30e9c..83ee32baa 100644
--- a/apparmor.d/groups/freedesktop/pipewire-media-session
+++ b/apparmor.d/groups/freedesktop/pipewire-media-session
@@ -14,9 +14,9 @@ profile pipewire-media-session @{exec_path} {
   include <abstractions/bus-session>
   include <abstractions/bus-system>
   include <abstractions/bus/org.freedesktop.RealtimeKit1>
+  include <abstractions/camera>
   include <abstractions/devices-usb>
   include <abstractions/nameservice-strict>
-  include <abstractions/video>
 
   network bluetooth raw,
   network bluetooth seqpacket,
diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio
index 05e4c3ec2..28d8b9d31 100644
--- a/apparmor.d/groups/freedesktop/pulseaudio
+++ b/apparmor.d/groups/freedesktop/pulseaudio
@@ -18,6 +18,7 @@ profile pulseaudio @{exec_path} {
   include <abstractions/bus/org.freedesktop.Avahi>
   include <abstractions/bus/org.freedesktop.hostname1>
   include <abstractions/bus/org.freedesktop.RealtimeKit1>
+  include <abstractions/camera>
   include <abstractions/consoles>
   include <abstractions/dconf-write>
   include <abstractions/dri>
@@ -105,7 +106,6 @@ profile pulseaudio @{exec_path} {
 
   @{sys}/devices/**/sound/**/{uevent,pcm_class} r,
   @{sys}/devices/virtual/dmi/id/{bios_vendor,board_vendor,sys_vendor} r,
-  @{sys}/devices/virtual/video4linux/video@{int}/uevent r,
 
   deny @{sys}/module/apparmor/parameters/enabled r,
 
@@ -114,7 +114,6 @@ profile pulseaudio @{exec_path} {
   owner @{PROC}/@{pids}/cmdline r,
 
   /dev/media@{int} r,
-  /dev/video@{int} rw,
 
   # file_inherit
   owner /dev/tty@{int} rw,
diff --git a/apparmor.d/groups/freedesktop/wireplumber b/apparmor.d/groups/freedesktop/wireplumber
index aefdc339d..708e5a6e8 100644
--- a/apparmor.d/groups/freedesktop/wireplumber
+++ b/apparmor.d/groups/freedesktop/wireplumber
@@ -16,9 +16,9 @@ profile wireplumber @{exec_path} {
   include <abstractions/bus/org.freedesktop.impl.portal.PermissionStore>
   include <abstractions/bus/org.freedesktop.RealtimeKit1>
   include <abstractions/bus/org.freedesktop.UPower>
+  include <abstractions/camera>
   include <abstractions/devices-usb>
   include <abstractions/nameservice-strict>
-  include <abstractions/video>
 
   network bluetooth raw,
   network bluetooth seqpacket,
@@ -71,7 +71,6 @@ profile wireplumber @{exec_path} {
 
   @{sys}/bus/ r,
   @{sys}/bus/media/devices/ r,
-  @{sys}/devices/@{pci}/video4linux/video@{int}/uevent r,
   @{sys}/devices/**/device:*/{,**/}path r,
   @{sys}/devices/**/sound/**/pcm_class r,
   @{sys}/devices/**/sound/**/uevent r,
diff --git a/apparmor.d/profiles-s-z/signal-desktop b/apparmor.d/profiles-s-z/signal-desktop
index 001f8605a..4abe053f6 100644
--- a/apparmor.d/profiles-s-z/signal-desktop
+++ b/apparmor.d/profiles-s-z/signal-desktop
@@ -19,6 +19,7 @@ profile signal-desktop @{exec_path} flags=(attach_disconnected) {
   include <abstractions/audio-client>
   include <abstractions/bus-session>
   include <abstractions/bus/org.kde.StatusNotifierWatcher>
+  include <abstractions/camera>
   include <abstractions/common/electron>
   include <abstractions/devices-usb-read>
   include <abstractions/notifications>
diff --git a/apparmor.d/profiles-s-z/vlc b/apparmor.d/profiles-s-z/vlc
index ccf1abb61..3a3a77313 100644
--- a/apparmor.d/profiles-s-z/vlc
+++ b/apparmor.d/profiles-s-z/vlc
@@ -17,6 +17,7 @@ profile vlc @{exec_path} {
   include <abstractions/bus/org.freedesktop.secrets>
   include <abstractions/bus/org.kde.kwalletd>
   include <abstractions/bus/org.kde.StatusNotifierWatcher>
+  include <abstractions/camera>
   include <abstractions/dconf-write>
   include <abstractions/desktop>
   include <abstractions/devices-usb>
@@ -85,7 +86,6 @@ profile vlc @{exec_path} {
         /dev/shm/#@{int} rw,
         /dev/snd/ r,
         /dev/tty r,
-        /dev/video@{int} rw,
   owner /dev/tty@{int} rw,
 
   # Silencer