Cannot access camera device /dev/video0 when added to Gramine manifest

[Obessiveness]

I'm exploring the use of Gramine to create a Trusted Execution Environment (TEE) that can ensure video streams come from a trusted physical camera rather than a virtual device. My goal is to provide hardware-based attestation that video data originates from a genuine physical camera.

When I add my camera device (/dev/video0) to the Gramine manifest file, my application fails to open the camera device with an error:

[ WARN:0@0.518] global cap_v4l.cpp:914 open VIDEOIO(V4L2:/dev/video0): can't open camera by index
[ERROR:0@0.519] global obsensor_uvc_stream_channel.cpp:163 getStreamChannelGroup Camera index out of range
[ WARN:0@0.521] global cap.cpp:779 open VIDEOIO(CV_IMAGES): raised OpenCV exception:

OpenCV(4.12.0) /io/opencv/modules/videoio/src/cap_images.cpp:415: error: (-215:Assertion failed) !filename_pattern.empty() in function 'CvVideoWriter_Images'

The same program works correctly when run natively outside Gramine.

I attached my code file and log file below.

camera_test.py

debug_cv2.log

[kailun-qin]

I'm exploring the use of Gramine to create a Trusted Execution Environment (TEE) that can ensure video streams come from a trusted physical camera rather than a virtual device. My goal is to provide hardware-based attestation that video data originates from a genuine physical camera.

When I add my camera device (/dev/video0) to the Gramine manifest file

In Gramine, communication with allowed devices is pass-through and thus potentially insecure by itself (pls see https://gramine.readthedocs.io/en/latest/manifest-syntax.html#allowed-files), which means it does not really serve your purpose.