Preventing non-portal access to webcam/microphone

Project Discussion
1

I saw a question about this in relation to Fedora Workstation where I pointed out that sandbox settings dont apply to non sandboxed apps.

However thinking about it more for SIlverblue, there should not be any apps that access the webcam that are not sandboxed.

So how do I “break” the system here to prevent access to these devices outside of a sandbox?

(I know that cheese does not use the sandbox yet so it will be non-functional).

If it is simple enough, maybe it should be done for Silverblue 36 (which will give some time for the apps to update for the change).

EDIT - and yes, any good recommendations for sandboxed webcam apps?

2

To do this the Shell would have to place each application it launches automatically in a sandbox. This is doable but unimplemented AFAIK.