SteamOS bypasses Wayland's input isolation by granting uaccess to keyboards

[sebihotza]

Your system information

• Steam client version: 1789781627
• SteamOS version: SteamOS 3.9.1 Build: 20260914.100
• Opted into Steam client beta?: Yes
• Opted into SteamOS beta?: Yes
• Have you checked for updates in Settings > System?: Yes
• Device: Steam Deck LCD

Please describe your issue in as much detail as possible:

Expected behavior: Unprivileged users should not be able to read keyboard inputs through /dev/input. This is particularly important under Wayland because only focused foreground apps are expected to access the keyboard on Wayland sessions.
Actual behavior: Due to the way SteamOS grants uaccess via udev rules, many keyboards are exposed to unprivileged user processes. As far as I understand, this is caused by /usr/lib/udev/rules.d/70-steamos-power-button.rules for any Bluetooth or USB input device that is correctly or incorrectly labeled as a power button, which includes my Logitech K380s. Furthermore, there is another rule in /usr/lib/udev/rules.d/70-steam-jupiter-input.rules that grants uaccess to any USB device.

Steps for reproducing this issue:

1. Switch to desktop mode.
2. Connect a keyboard via Bluetooth or USB.
3. Launch Konsole.
4. Run evtest without sudo/root privileges.
5. Select the device event number corresponding to the keyboard.
6. Press any key on the keyboard to see the keystroke printed.