GNOME Background Portal Permissions for Location and Webcam

GNOME restricts unauthorized access to sensitive hardware and user data by utilizing the XDG Desktop Portal framework, a centralized permission store, and background runtime monitors. When sandboxed applications (such as Flatpaks) request access to webcam streams or geolocation while running in the background, GNOME coordinates between D-Bus interfaces, system daemons like PipeWire and Geoclue, and GNOME Shell indicators. This architecture ensures that background services cannot covertly capture video or track user movement without explicit, persistent user consent and continuous visual feedback.

The Portal Framework and D-Bus Communication

The core of GNOME's permission handling is xdg-desktop-portal combined with its desktop-specific backend, xdg-desktop-portal-gnome. When an application inside a sandbox attempts to access restricted resources, it bypasses direct device access (such as /dev/video*) and instead makes a request over the D-Bus session bus to the appropriate portal interface:

  • Camera Portal: org.freedesktop.portal.Camera
  • Location Portal: org.freedesktop.portal.Location
  • Background Portal: org.freedesktop.portal.Background

xdg-desktop-portal routes these requests to xdg-desktop-portal-gnome, which triggers native GNOME Shell dialogs to request user approval if the permission has not already been granted.

Managing Webcam Streams via PipeWire

GNOME does not grant applications raw device access to webcams. Instead, video streaming relies on PipeWire's multimedia routing framework:

  1. Request and Prompt: The application requests a camera session through the Camera portal. If not previously allowed, GNOME displays an access dialog.
  2. PipeWire Node Assignment: Upon approval, the portal requests a restricted PipeWire stream. PipeWire creates a sandboxed file descriptor that points strictly to the negotiated video stream.
  3. Handoff: The file descriptor is passed back across the sandbox boundary. The application interacts with PipeWire, having no awareness of or access to the underlying hardware node.
  4. Revocation: If permissions are revoked or the session is terminated, GNOME signals PipeWire to sever the stream, instantly cutting access.

Handling Geolocation via Geoclue

Location tracking is handled similarly through an integration between the Location portal and Geoclue, the system-level location service:

  1. Portal Mediation: An application requests continuous or one-off location updates through the Location portal.
  2. Policy Evaluation: GNOME checks its internal permission database to determine whether the app is authorized and whether location services are globally enabled.
  3. Accuracy Throttling: The portal allows GNOME to deliver differing accuracy tiers (city-level, street-level, or exact coordinates) depending on the configuration and permissions granted.
  4. Data Delivery: Geoclue supplies location fixes to the portal, which forwards them to the application. If the global location switch is toggled off in GNOME Settings, the portal terminates the data feed immediately.

Background Access Control

Accessing data while an application lacks an open, focused window requires clearing the Background portal. GNOME implements specific safeguards to prevent background spying:

  • Background Registration: When an application seeks to persist without an active window, it calls the Background portal interface. GNOME records whether the application is permitted to autostart or run persistently.
  • Permission Checks on Stream Requests: If an application requests camera frames or location data while backgrounded, GNOME verifies both the hardware-specific permission (Camera/Location) and the background execution permission. If the app is suspended or denied background privileges, access requests are rejected.
  • Top Bar Privacy Indicators: When any application—foreground or background—receives location data or accesses a camera via PipeWire, GNOME Shell displays prominent privacy icons in the top panel. Clicking these indicators reveals which application is active, allowing users to close the app or revoke permissions immediately.

Permission Storage and Management

All user decisions are stored persistently in the xdg-permission-store, a dedicated database managed by the portal service.

Users can view and alter these settings at any time within GNOME:

  • GNOME Settings (Control Center): The Privacy & Security panel provides granular toggles for the Camera, Location Services, and Background Apps, enabling users to grant, modify, or revoke permissions on a per-application basis.
  • Command-Line Administration: Flatpak users can inspect and reset these permissions manually using the flatpak permission-show and flatpak permission-reset commands to alter entries in the permission store directly.