Calls

Webcam and microphone

Keep locked Speakers and USB headset playback stay. Capture is locked at the kernel (modules + udev) and again in Origin/Trivalent policy. Open the kernel if a native/Flatpak app needs it; open the browser pack only if the website needs it.

  1. Hardware for local apps

    ujust set-camera-mic on

    Then replug the webcam or run0 modprobe uvcvideo. Flatpak apps still need a device grant in Flatseal. This does not by itself give meet.example the camera.

  2. Websites are a second door

    Device policy blocks camera/mic/geo/USB/serial/HID/FS API in the house browser. If a video call is in the browser:

    ujust set-brave-devices off

    Restart Origin or Trivalent. That is a wide hole (USB and HID go with it). Prefer a Flatpak client with a tight Flatseal grant when you can.

  3. Flatpak record is a third door

    Stock leaves Pulse/PipeWire capture open to Flatpaks. We block it even if you loosen folder lockdown. A Flatpak that needs to record (or hear other apps) is:

    ujust set-flatpak-record off

    Speakers in native apps stay. Put it back when the call ends.

Browserless: there is no house browser policy. Host browsers stay blocked until ujust set-allow-browsers on ALLOW. A random Firefox is usually worse than stock Trivalent — rebase to *-trivalent if you wanted a jailed Chromium.