Video Devices inside of Podman Quadlet Container

[BStenfors9119]

I would like to understand more in depth how permissions work for video (capture card) devices and how they can be accessed inside of a podman quadlet container.

My scenario:

• OS: Fedora Silverblue
• Application: single rust app that calls "v4l2-ctl --list-devices" inside the container but receives Permission Denied

If I run the "v4l2-ctl --list-devices" via "podman exec" directly or even inside the container via "podman exec [container name] /bin/bash" it succeeds perfectly.

I have added the user creating / starting the quadlet to the video group via "usermod -aG video $USER".
I have also set privileged to true (without this no access at all).

Here is my current Quadlet container unit file:

[Unit]
Description=My App Quadlet Container
Wants=network-online.service my-app-build.service
After=network-online.service my-app-build.service

[Container]
ContainerName=my-app-quad
Image=localhost/my-app:latest
AutoUpdate=local
PublishPort=1111:1111
UserNS=keep-id
GroupAdd=keep-groups
AddCapability=CAP_SYS_ADMIN CAP_SYS_RAWIO
Exec=/usr/bin/my-app

PodmanArgs=--privileged

AddDevice=/dev/video0:/dev/video0:rw
AddDevice=/dev/video1:/dev/video1:rw
AddDevice=/dev/video2:/dev/video2:rw
AddDevice=/dev/video3:/dev/video3:rw

Volume=%h/releases:/releases:Z
Volume=/sys/fs/cgroup:/sys/fs/cgroup:rw
Volume=/run/user/%i:/run/user/%i:rw
Volume=/run/dbus:/run/dbus:ro
Volume=/run/systemd:/run/systemd:ro
Volume=/run/udev:/run/udev:ro
Volume=%h/polkit-rules:/etc/polkit-1/rules.d:ro
Volume=%h/tsr-prism-data/ads:/usr/lib/my-app/_data/ads:rw
Volume=%h/tsr-prism-data/uploads:/usr/lib/my-app/_data/uploads:rw
Volume=%h/tsr-prism-data/streams:/usr/lib/my-app/_data/streams:rw

[Service]
Restart=always
ExecStartPre=/bin/bash -c "mkdir -p %h/my-app-data/{ads,uploads,streams} || true"
ExecStartPre=/bin/bash -c "chown -R 1000:1000 %h/my-app-data || true"

[Install]
WantedBy=default.target 

I have also tried the following:

• --security-opt label=disable
• manually setting GIDMap to 39:39:1

I started working on this by following the steps in this blog post:
https://www.redhat.com/en/blog/files-devices-podman

Any ideas / suggestions are greatly appreciated :).

[eriksjolund]

Have you tried to temporarily switch SELinux to permissive mode

setenforce 0

?

After testing, use

setenforce 1

to switch SELinux back to enforcing mode.