when loggin as xguest i dont find any audio device.

[Peder]

Hello everyone!
I have tried to get xguest work in my enviorment for a while and just for fun tested it with fedora 17, it works almost great. The environment is Gnome 3.
But I have problem to get the sound to work when i'm logged in as xguest. There is no problem when i'm in as admin or a standard user.
In the message log i found this

Apr 4 09:15:44 localhost pulseaudio[1747]: [pulseaudio] authkey.c: Failed to open cookie file '/var/lib/xguest/home/xguest/.esd_auth': Filen eller katalogen finns inte
Apr 4 09:15:44 localhost pulseaudio[1747]: [pulseaudio] authkey.c: Failed to load authorization key '/var/lib/xguest/home/xguest/.esd_auth': Filen eller katalogen finns inte

the end of the messege is swedish translation "File or catalog does not exist"

The symbol for volym control in the upper right corner does not show

Then I loggin as admin, The selinux tells me this:
type=AVC msg=audit(1333523734.720:129): avc: denied { create } for pid=1510 comm="pulseaudio" name=".pulse-cookie" scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333523734.720:129): arch=c000003e syscall=2 success=no exit=-13 a0=1ac3300 a1=80142 a2=180 a3=322124947c items=0 ppid=1505 pid=1510 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=3 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
And its a lot more.

Have anyone seen this before, and do anyone have any suggestions?

[domg472]

What else more?

Seems some rules are missing.

This:

mkdir ~/mypulseaudio; cd ~/mypulseaudio;
echo "module mypulseaudio 1.0; require { type pulseaudio_t, pulseaudio_home_t, user_home_dir_t; class file getattr; } type_transition pulseaudio_t user_home_dir_t:file pulseaudio_home_t \".pulse-cookie\"; " > mypulseaudio.te
checkmodule -M -m -o mypulseaudio.mod mypulseaudio.te
semodule_package -o mypulseaudio.pp -m mypulseaudio.mod
sudo semodule -i mypulseaudio.pp

should at least take care of this:

avc: denied { create } for pid=1510 comm="pulseaudio" name=".pulse-cookie" scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file

[Peder]

Thank you for the quick reply!
I will try it out later to day.
Heres the rest of the audit.log, This will come as son the xgust loggin.

type=AVC msg=audit(1333607702.508:228): avc:  denied  { read write open } for  pid=2077 comm="pulseaudio" name=".pulse-cookie" dev="tmpfs" ino=23534 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333607702.508:228): arch=c000003e syscall=2 success=no exit=-13 a0=15d4300 a1=80142 a2=180 a3=322124947c items=0 ppid=2073 pid=2077 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
type=AVC msg=audit(1333607702.528:229): avc:  denied  { read } for  pid=2077 comm="pulseaudio" name=".pulse-cookie" dev="tmpfs" ino=23534 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333607702.528:229): arch=c000003e syscall=2 success=no exit=-13 a0=15d4300 a1=0 a2=d a3=322124947c items=0 ppid=2073 pid=2077 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
type=AVC msg=audit(1333607702.570:230): avc:  denied  { setattr } for  pid=2080 comm="autospawn" name=".pulse" dev="tmpfs" ino=23544 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=dir
type=SYSCALL msg=audit(1333607702.570:230): arch=c000003e syscall=93 success=no exit=-13 a0=5 a1=3e9 a2=3e9 a3=3221249eb1 items=0 ppid=2073 pid=2080 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="autospawn" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
type=AVC msg=audit(1333607702.579:231): avc:  denied  { rmdir } for  pid=2080 comm="autospawn" name=".pulse" dev="tmpfs" ino=23544 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=dir
type=SYSCALL msg=audit(1333607702.579:231): arch=c000003e syscall=84 success=no exit=-13 a0=7f8fcc000950 a1=3e9 a2=d a3=3221249eb1 items=0 ppid=2073 pid=2080 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="autospawn" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
type=AVC msg=audit(1333607703.242:232): avc:  denied  { read write } for  pid=2074 comm="gnome-settings-" name=".pulse-cookie" dev="tmpfs" ino=23534 scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333607703.242:232): arch=c000003e syscall=2 success=no exit=-13 a0=1aac050 a1=80142 a2=180 a3=322124947c items=0 ppid=1914 pid=2074 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="gnome-settings-" exe="/usr/libexec/gnome-settings-daemon" subj=xguest_u:xguest_r:xguest_t:s0 key=(null)
type=AVC msg=audit(1333607703.243:233): avc:  denied  { read } for  pid=2074 comm="gnome-settings-" name=".pulse-cookie" dev="tmpfs" ino=23534 scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333607703.243:233): arch=c000003e syscall=2 success=no exit=-13 a0=1aac050 a1=0 a2=d a3=322124947c items=0 ppid=1914 pid=2074 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="gnome-settings-" exe="/usr/libexec/gnome-settings-daemon" subj=xguest_u:xguest_r:xguest_t:s0 key=(null)
type=AVC msg=audit(1333607703.265:234): avc:  denied  { read write } for  pid=2105 comm="pulseaudio" name=".pulse-cookie" dev="tmpfs" ino=23534 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333607703.265:234): arch=c000003e syscall=2 success=no exit=-13 a0=1915300 a1=80142 a2=180 a3=322124947c items=0 ppid=2074 pid=2105 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
type=AVC msg=audit(1333607703.268:235): avc:  denied  { read } for  pid=2105 comm="pulseaudio" name=".pulse-cookie" dev="tmpfs" ino=23534 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333607703.268:235): arch=c000003e syscall=2 success=no exit=-13 a0=1915300 a1=0 a2=d a3=322124947c items=0 ppid=2074 pid=2105 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
type=AVC msg=audit(1333607703.272:236): avc:  denied  { setattr } for  pid=2107 comm="autospawn" name=".pulse" dev="tmpfs" ino=23544 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=dir
type=SYSCALL msg=audit(1333607703.272:236): arch=c000003e syscall=93 success=no exit=-13 a0=6 a1=3e9 a2=3e9 a3=3221249eb1 items=0 ppid=2074 pid=2107 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="autospawn" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
type=AVC msg=audit(1333607703.272:237): avc:  denied  { rmdir } for  pid=2107 comm="autospawn" name=".pulse" dev="tmpfs" ino=23544 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=dir
type=SYSCALL msg=audit(1333607703.272:237): arch=c000003e syscall=84 success=no exit=-13 a0=7fecd8000950 a1=3e9 a2=d a3=3221249eb1 items=0 ppid=2074 pid=2107 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="autospawn" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
type=USER_AVC msg=audit(1333607703.579:238): pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.30 spid=2074 tpid=1094 scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=system_u:system_r:colord_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1333607703.604:239): pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.ColorManager member=GetDevices dest=:1.30 spid=2074 tpid=1094 scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=system_u:system_r:colord_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=AVC msg=audit(1333607704.658:240): avc:  denied  { read write } for  pid=2135 comm="gnome-shell" name=".pulse-cookie" dev="tmpfs" ino=23534 scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333607704.658:240): arch=c000003e syscall=2 success=no exit=-13 a0=1e575e0 a1=80142 a2=180 a3=3207bb07b8 items=0 ppid=1914 pid=2135 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="gnome-shell" exe="/usr/bin/gnome-shell" subj=xguest_u:xguest_r:xguest_t:s0 key=(null)
type=AVC msg=audit(1333607704.659:241): avc:  denied  { read } for  pid=2135 comm="gnome-shell" name=".pulse-cookie" dev="tmpfs" ino=23534 scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333607704.659:241): arch=c000003e syscall=2 success=no exit=-13 a0=1e575e0 a1=0 a2=d a3=3207bb07b8 items=0 ppid=1914 pid=2135 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="gnome-shell" exe="/usr/bin/gnome-shell" subj=xguest_u:xguest_r:xguest_t:s0 key=(null)
type=AVC msg=audit(1333607704.705:242): avc:  denied  { read write } for  pid=2184 comm="pulseaudio" name=".pulse-cookie" dev="tmpfs" ino=23534 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333607704.705:242): arch=c000003e syscall=2 success=no exit=-13 a0=6e3300 a1=80142 a2=180 a3=322124947c items=0 ppid=2135 pid=2184 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=5 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
type=AVC msg=audit(1333607704.710:243): avc:  denied  { read } for  pid=2184 comm="pulseaudio" name=".pulse-cookie" dev="tmpfs" ino=23534 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file

When I pasted everything in to the forum it complained over it to be to big, but it all look the same.

[domg472]

Use this instead:

mkdir ~/mypulseaudio; cd ~/mypulseaudio;
echo "module mypulseaudio 1.0; require { type pulseaudio_t, xguest_t, pulseaudio_home_t, user_home_dir_t; class file getattr; class dir getattr; } type_transition { xguest_t pulseaudio_t } user_home_dir_t:file pulseaudio_home_t \".pulse-cookie\";  type_transition { xguest_t pulseaudio_t } user_home_dir_t:dir pulseaudio_home_t \".pulse\"; " > mypulseaudio.te
checkmodule -M -m -o mypulseaudio.mod mypulseaudio.te
semodule_package -o mypulseaudio.pp -m mypulseaudio.mod
sudo semodule -i mypulseaudio.pp

Basically this policy configuration is telling the security server that xguest and pulseaudio should create ~/.pulse-cookie file and ~/.pulse directorory with type pulseaudio_home_t.

This should allow pulseaudio and xguest to operate on thos objects.

After this there might still be similar issue for ~/.esd_auth file but you did not enclose AVC denials for that so i will wait to see if they show up later.

This:

avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=:1.30 spid=2074 tpid=1094 scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=system_u:system_r:colord_t:s0 tclass=dbus

can probably be ignored. selinux is blocking xguest attempts to chat via dbus to colord. (shouldnt be causing any loss in functionality)

[domg472]

Use this:

mkdir ~/mypulseaudio; cd ~/mypulseaudio;
echo "module mypulseaudio 1.0; require { type pulseaudio_t, xguest_t, pulseaudio_home_t, user_home_dir_t; class file getattr; class dir getattr; } type_transition { xguest_t pulseaudio_t } user_home_dir_t:file pulseaudio_home_t \".pulse-cookie\";  type_transition { xguest_t pulseaudio_t } user_home_dir_t:file pulseaudio_home_t \".esd_auth\"; type_transition { xguest_t pulseaudio_t } user_home_dir_t:dir pulseaudio_home_t \".pulse\"; " > mypulseaudio.te
checkmodule -M -m -o mypulseaudio.mod mypulseaudio.te
semodule_package -o mypulseaudio.pp -m mypulseaudio.mod
sudo semodule -i mypulseaudio.pp

That will tell the security server that if either xguest or pulseaudio create .esd_auth in ~ that the security server should type transition the .esh_auth file from user_home_dir_t to pulseaudio_home_t.

That will fix that issue

[Peder]

Now the audit.log lock different. Still no audiodevice when loggin as xguest.

Like you told me in your post the ~/esd_auth is still there.

Heres what the audit.log says

type=AVC msg=audit(1333613223.183:433): avc:  denied  { read write open } for  pid=3920 comm="pulseaudio" name=".esd_auth" dev="tmpfs" ino=32343 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333613223.183:433): arch=c000003e syscall=2 success=no exit=-13 a0=c60b20 a1=80142 a2=180 a3=322124947c items=0 ppid=3919 pid=3920 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=11 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
type=AVC msg=audit(1333613223.189:434): avc:  denied  { read } for  pid=3920 comm="pulseaudio" name=".esd_auth" dev="tmpfs" ino=32343 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333613223.189:434): arch=c000003e syscall=2 success=no exit=-13 a0=c60b20 a1=0 a2=d a3=322124947c items=0 ppid=3919 pid=3920 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=11 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
type=AVC msg=audit(1333613223.462:435): avc:  denied  { read write } for  pid=3932 comm="pulseaudio" name=".esd_auth" dev="tmpfs" ino=32343 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333613223.462:435): arch=c000003e syscall=2 success=no exit=-13 a0=cbfb70 a1=80142 a2=180 a3=322124947c items=0 ppid=3931 pid=3932 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=11 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)
type=AVC msg=audit(1333613223.464:436): avc:  denied  { read } for  pid=3932 comm="pulseaudio" name=".esd_auth" dev="tmpfs" ino=32343 scontext=xguest_u:xguest_r:pulseaudio_t:s0 tcontext=xguest_u:object_r:user_home_dir_t:s0 tclass=file
type=SYSCALL msg=audit(1333613223.464:436): arch=c000003e syscall=2 success=no exit=-13 a0=cbfb70 a1=0 a2=d a3=322124947c items=0 ppid=3931 pid=3932 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=11 comm="pulseaudio" exe="/usr/bin/pulseaudio" subj=xguest_u:xguest_r:pulseaudio_t:s0 key=(null)

I got this from the message log

Apr  5 10:43:51 localhost gnome-keyring-daemon[5134]: Could not connect: Permission denied
Apr  5 10:43:51 localhost pulseaudio[5308]: [pulseaudio] authkey.c: Failed to open cookie file '/var/lib/xguest/home/xguest/.esd_auth': Åtkomst nekas
Apr  5 10:43:51 localhost pulseaudio[5308]: [pulseaudio] authkey.c: Failed to load authorization key '/var/lib/xguest/home/xguest/.esd_auth': Åtkomst nekas
Apr  5 10:43:51 localhost pulseaudio[5308]: [pulseaudio] module.c: Failed to load module "module-esound-protocol-unix" (argument: ""): initialization failed.
Apr  5 10:43:51 localhost pulseaudio[5308]: [pulseaudio] main.c: Module load failed.
Apr  5 10:43:51 localhost pulseaudio[5308]: [pulseaudio] main.c: Failed to initialize daemon.
Apr  5 10:43:51 localhost setroubleshoot: SELinux is preventing /usr/bin/pulseaudio from 'read, write, open' accesses on the file .esd_auth. For complete SELinux messages. run sealert -l 5c0b8e2c-e135-4327-86e8-c13b6c02d082
Apr  5 10:43:51 localhost pulseaudio[5328]: [pulseaudio] authkey.c: Failed to open cookie file '/var/lib/xguest/home/xguest/.esd_auth': Åtkomst nekas
Apr  5 10:43:51 localhost pulseaudio[5328]: [pulseaudio] authkey.c: Failed to load authorization key '/var/lib/xguest/home/xguest/.esd_auth': Åtkomst nekas
Apr  5 10:43:51 localhost pulseaudio[5328]: [pulseaudio] module.c: Failed to load module "module-esound-protocol-unix" (argument: ""): initialization failed.
Apr  5 10:43:51 localhost pulseaudio[5328]: [pulseaudio] main.c: Module load failed.
Apr  5 10:43:51 localhost pulseaudio[5328]: [pulseaudio] main.c: Failed to initialize daemon.
Apr  5 10:43:51 localhost pulseaudio[5325]: [pulseaudio] main.c: Daemon startup failed.

[Peder]

Jepp it did, and now the sound works just fine with xguest. Thanks a lot.

---------- Post added at 02:14 PM ---------- Previous post was at 01:48 PM ----------

Or not.
The sound was piped to the dummy device. hmm I will do some more research soon.

[yveslec]

this problem seams recurrent.
I got this problem too on my Fedora14, that I just used quite two years.

So today with a fresh installation of Fedora17 x86_64, from the DVD beta, I still have the same problem: no sound for ordinary users,
while in a full session root
( obtained with:
default.target -> /lib/systemd/system/runlevel3.target , +login in ascii session on tty1, + startx & )
the sound device is accessed normally.
I try to use the method described above, but I just get the disappearing of dumb device (producing no sound anyway, even before applying this method).

So I apply the very simple method , yet efficient in Fedora14:
make any ordinary account invited in following group:
audio , video, pulse-access

by just editing /etc/groups, as in example below:
video:x:39:yves
dip:x:40:
ftp:x:50:
lock:x:54:
audio:x:63:yves
...
pulse:x:984:
pulse-access:x:983:yves,root,user1,guest
gdm:x:42:

In fact , for sound , only pulse-acces group ownership is sufficient.
I'm using modification of video and audio only required for kafeine, with my TV card HAUPPAUGE WinTV HVR4000 PCI, when I'm using it as ordinary users

[wagner17]

yveslec, the bug you mentioned has already been reported (see https://bugzilla.redhat.com/show_bug.cgi?id=751902) but is probably never going to get fixed because everyone just applies the workaround you mentioned.