LensGuard

Architecture

LensGuard keeps the desktop interface, monitoring service, and privileged observer separate. The GNOME Shell extension communicates with the unprivileged camera-monitor over user-session D-Bus; that service receives versioned Unix IPC messages from the privileged lensguard-v4l2-observer.

The observer uses eBPF tracepoints to report successful V4L2 stream start and stop events, then routes only direct camera-use events to the matching user. This boundary keeps camera frames and video buffers out of the system entirely.

Highlights

• Detects successful V4L2 streaming capture from browsers and Electron clients.
• Shows the application and physical camera in GNOME Quick Settings.
• Observes metadata only—never frames, video buffers, command lines, or persistent history.