[DevomB]

This is the audit's camera:5.

Until now, nothing could check a real camera:

• The zone probe took its frame with read(), which uvcvideo doesn't implement: uvc_fops has no .read, and the capture node has only VIDEO_CAPTURE and STREAMING (v6.18.56).
• camera-check.sh always loaded vivid first, so a run on a laptop granted vivid's node.
• The path a real camera takes when a program keeps its descriptor (uvcvideo pinned, "stayed", the next grant refused) was never exercised.

Probe, both modes. It lists the node's formats (VIDIOC_ENUM_FMT) and takes frames by mmap streaming: REQBUFS, QUERYBUF, mmap, QBUF, STREAMON, then select and DQBUF. That is the path a browser takes. A frame counts when bytesused is non-zero and the buffer isn't flagged as an error. While held, it prints DQBUF-FAILED errno once the node is gone. With keep, it then holds the descriptor two minutes more. The zone's allowlist already has select, mmap, dup and ioctl.

QEMU run (zones-test.sh, unchanged call and check names):

• It refuses to start if a video-class USB interface is present, and names --hardware.
• camera-granted also checks that the granted node's own device driver is vivid.
• camera-zone-captures also asks for MJPG or YUYV among the formats (vivid offers YUYV).
• camera-ends-with-zone-again also checks that uvcvideo unloaded.

camera-check.sh USER --hardware, run as root at a console of the installed laptop, never loads vivid:

• camera-hardware: a video-class USB interface exists, uvcvideo isn't loaded, and kryptikd camera status reads exactly none, meaning no grant this boot.
• The same grant, refusal and capture checks as the QEMU run, with uvcvideo as the driver. camera-other-zone-none runs only in QEMU, since it needs a passphrase file that run makes.
• camera-revoked: with a program holding the node across k, the launcher prints untrusted stayed, uvcvideo stays loaded, and status reads none; its driver stayed loaded. The held descriptor's DQBUF fails.
• camera-kept-refuses-grant: a grant while that descriptor is held is refused with camera.rs's "still holds the camera".
• Once the holder is gone, the next grant captures. At its end status reads none and uvcvideo unloads.
• camera-gone-ends-grant writes 0 to the USB device's authorized. That device is found from the granted node, so a separate infrared camera can't be taken by mistake. The grant ends through udev's kryptikd camera gone, and authorized is written back to 1.
• camera-back-loads-nothing: the camera comes back, and uvcvideo isn't loaded.

docs/design/camera.md (Check) and docs/hardware.md gain a row that runs it before any k. That row comes after #674's camera usb listing row, which is why this is based on zbook-batch-6.

Testing on physical hardware is planned for October 2026.