# Hide raw IPU7 ISYS capture devices from ALL applications.
# These are internal ISP nodes that output raw 12-bit Bayer data and cannot produce usable frames.
# Camera is provided via v4l2loopback (/dev/video50) through v4l2-relayd instead.
#
# This rule MUST run after 70-uaccess.rules (which adds TAG="uaccess" to video4linux)
# but BEFORE 73-seat-late.rules (which applies per-user ACLs based on that tag).
# MODE=0600 + GROUP=root blocks even users in the 'video' group.
SUBSYSTEM=="video4linux", ATTR{name}=="Intel IPU7 ISYS Capture *", TAG-="uaccess", TAG-="seat", MODE="0600", GROUP="root"