Calls
Webcam and microphone
Keep locked Speakers and USB headset playback stay. Capture is locked at the kernel (modules + udev) and again in Origin/Trivalent policy. Open the kernel if a native/Flatpak app needs it; open the browser pack only if the website needs it.
-
Hardware for local apps
ujust set-camera-mic onThen replug the webcam or
run0 modprobe uvcvideo. Flatpak apps still need a device grant in Flatseal. This does not by itself givemeet.examplethe camera. -
Websites are a second door
Device policy blocks camera/mic/geo/USB/serial/HID/FS API in the house browser. If a video call is in the browser:
ujust set-brave-devices offRestart Origin or Trivalent. That is a wide hole (USB and HID go with it). Prefer a Flatpak client with a tight Flatseal grant when you can.
-
Flatpak record is a third door
Stock leaves Pulse/PipeWire capture open to Flatpaks. We block it even if you loosen folder lockdown. A Flatpak that needs to record (or hear other apps) is:
ujust set-flatpak-record offSpeakers in native apps stay. Put it back when the call ends.
Browserless: there is no house browser policy. Host browsers stay blocked until ujust set-allow-browsers on ALLOW. A random Firefox is usually worse than stock Trivalent — rebase to *-trivalent if you wanted a jailed Chromium.