All apps are granted camera access by default

[Bob Meyers]

In the same architectural spirit as:

https://bugs.launchpad.net/elementaryos/+bug/1559455
https://bugs.launchpad.net/elementaryos/+bug/1559367

there should be a camera enable/disable switch/button at the top of every app window, which is disabled by default. Or do it like VMWare and have a dropdown menu. Whatever you like. All that matters is that the functionality is easily accessible.

Why? Because the user owns the machine, not the app. Want your security camera app to watch your lobby? No problem, disable its network access so it can't send the images anywhere. Want to play a game on the net? Fine, turn on network access but shut off the camera and microphone so it can't invade your life. You get the idea.

If you implement all 3 of these wishlist items (microphone, network, and camera), you will eliminate almost all the same threats that heavy handed virtual machines eliminate, with much less overhead, latency, and inconvenience. It would make Elementary stand above the crowd of less security-conscious Linux distros, without sacrificing ease-of-use.

[Danielle Foré (danrabbit)]

I don't think adding a switch in every window makes sense as this would be unenforceable, but we should sandbox access to hardware inputs like the camera and probably centrally manage this from the Security & Privacy settings

[Bob Meyers (bobgmeyers)]

It's up to you, but I think a switch in every window is actually enforcable. You would just need to trap the relatively few OS calls which result in camera communication. This would be a lightweight form of virtualization, much much simpler than paravirtualization of the kernel.

If you go the global route, there's no way to partition which app gets access. So a "phone home" piece of malware just needs to sit around waiting for the global enable to get set. (This applies to all hazardous devices, not just the camera.)