support /dev/video* in private-dev, bringing back private-dev in firefox profile

3 files changed, 13 insertions, 2 deletions

diff --git a/etc/firefox.profile b/etc/firefox.profile
index fd9fb7fe7..a6fe04800 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -60,7 +60,8 @@ include /etc/firejail/whitelist-common.inc
 # experimental features
 #private-bin firefox,which,sh,dbus-launch,dbus-send,env
 #private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
-# private-dev - prevents video calls going out
+# private-dev might prevent video calls going out
+private-dev
 private-tmp
 
 noexec ${HOME}
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index 20fcf56e7..9b73ac9fc 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -54,6 +54,16 @@ static DevEntry dev[] = {
         {"/dev/nvidiactl", RUN_DEV_DIR "/nvidiactl", 0, 1},
         {"/dev/nvidia-modeset", RUN_DEV_DIR "/nvidia-modeset", 0, 1},
         {"/dev/nvidia-uvm", RUN_DEV_DIR "/nvidia-uvm", 0, 1},
+        {"/dev/video0", RUN_DEV_DIR "/video0", 0, 1},
+        {"/dev/video1", RUN_DEV_DIR "/video1", 0, 1},
+        {"/dev/video2", RUN_DEV_DIR "/video2", 0, 1},
+        {"/dev/video3", RUN_DEV_DIR "/video3", 0, 1},
+        {"/dev/video4", RUN_DEV_DIR "/video4", 0, 1},
+        {"/dev/video5", RUN_DEV_DIR "/video5", 0, 1},
+        {"/dev/video6", RUN_DEV_DIR "/video6", 0, 1},
+        {"/dev/video7", RUN_DEV_DIR "/video7", 0, 1},
+        {"/dev/video8", RUN_DEV_DIR "/video8", 0, 1},
+        {"/dev/video9", RUN_DEV_DIR "/video9", 0, 1},
         {NULL, NULL, 0, 0}
 };
 
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 915a0d50d..38bb6a19e 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1218,7 +1218,7 @@ bash  cat  ls  sed
 
 .TP
 \fB\-\-private-dev
-Create a new /dev directory. Only dri, null, full, zero, tty, pts, ptmx, random, snd, urandom, log and shm devices are available.
+Create a new /dev directory. Only dri, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log and shm devices are available.
 .br
 
 .br