Blacklisting a kernel module would disable the microphone for all users. I have set up a restricted user, who should not be able to use the microphone. The restricted user should, however be able to have sound output. Is there a way of reliably disabling the microphone for a restricted user?
1 Answer
After experimenting a lot this seems to be the solution:
sudo setfacl -m u:user:- /dev/snd/pcmC0D0c
On my computer, /dev/snd/pcmC0D0c is the microphone. Blocking write access for a specific user seems to forbid capturing.
With the above command, I reduce the rights for the user "user" to --- (check with getfacl /dev/snd/pcmC0D0c), which does not allow for capturing sound.
Hint: for finding microphones in /dev/snd/ the c for capturing at the end of the name may be an indicator.
NOTE: As all changes made to /dev/ will be lost at reboot, as these files are placed in RAM, you would have to additionally add the above command (without sudo as /etc/rc.local is executed with root rights at boot) to /etc/rc.local before the "exit 0" line.