nevaforget
7568fe223d
Update PKGBUILD version / update-pkgver (push) Successful in 6s
Cameras are off after every boot and get switched on per camera from the bar. This inverts the privacy problem instead of chasing it: the previous entry point, detecting camera *use*, cannot see raw V4L2 access at all, and inotify on /dev/video* cannot tell a real capture from a device query. An unauthorized camera cannot be opened in the first place. Mechanism is `authorized` on the USB device. Measured: writing 0 drops the /dev/videoN nodes and the PipeWire node, writing 1 brings them back and uvcvideo rebinds itself. A camera is identified by USB interface class 0x0e in the descriptor blob, which stays complete while the device is deauthorized (the interface directories do not) — so no state of our own is needed to keep a switched-off camera listable and switchable. The privileged helper re-derives every precondition from kernel data: id shape, resolved path under /sys/devices, DEVTYPE=usb_device, and a video interface class. It cannot be used to deauthorize a hub, keyboard or disk. Switching a camera on authorizes the whole USB device, so the popout names every other function it carries and flags in red what does not belong on a camera. Shown rather than blocked: the internal camera carries a DFU interface and multimedia devices commonly expose HID for their buttons, so a class filter would lock out legitimate hardware. Device-supplied labels are rendered as plain text and stripped of the invisible and directional Unicode range, so a name cannot masquerade as another device's. A hot-plugged camera stays on — plugging one in is a deliberate act.
18 lines
478 B
Bash
Executable File
18 lines
478 B
Bash
Executable File
#!/bin/sh
|
|
# ABOUTME: Switches one camera on or off; dispatches the privileged sysfs write via pkexec.
|
|
# ABOUTME: Usage: moonarch-camera-toggle <usb-id> <0|1>. Exit code is pkexec's (126 = prompt cancelled).
|
|
|
|
ID="${1:-}"
|
|
VAL="${2:-}"
|
|
|
|
# Shape check only — moonarch-camera-apply re-validates everything as the privileged side.
|
|
case "$ID" in
|
|
""|*[!0-9.-]*) exit 1 ;;
|
|
esac
|
|
case "$VAL" in
|
|
0 | 1) ;;
|
|
*) exit 1 ;;
|
|
esac
|
|
|
|
pkexec /usr/bin/moonarch-camera-apply "$ID" "$VAL"
|