I have been playing around with firejail and tried to get a profile, where access to the webcam is blocked. I tried this with ‘cheese’ as an application, which shows the webcam and found --novideo in the documentation

So:

$ firejail --novideo cheese

And success, no video found.

But if I use that same configuration with a shell:

$ firejail --novideo bash

And then start cheese from there, video works fine. So access to the webcam is still possible? Does cheese connect to some other process?

I tried other promising settings, but I always was able to have cheese access the webcam. I assume if that program can access it, other programs could as well.