How to make a USB device available to a QEMU guest?

I am trying to make my laptop camera accessible by a guest system on it. With the guest system not running, I open it in virt-manager, go to "Show virtual hardware details" → "Add Hardware" → "USB Host Device". Here I choose my camera (001:002 Chicony Electronics Co., Ltd HD User Facing) and click "Finish". The procedure seems to be the same as described in the KVM documentation . This results in the following stanza added to the XML config of the guest machine.

-xml

This looks correct according to the Red Hat's manual on attaching and updating a device with virsh . However, I cannot run the guest with it because qemu is denied permission.

Error starting domain: internal error: qemu unexpectedly closed the monitor: 2022-03-13T05:27:57.240470Z qemu-system-x86_64: -device {"driver":"usb-host","hostdevice":"/dev/bus/usb/001/002","id":"hostdev0","bus":"usb.0","port":"6"}: failed to open /dev/bus/usb/001/002: Permission denied

Traceback (most recent call last):
  File "/gnu/store/r9jxh3pv020qa05pza3jiky2vppn68mx-virt-manager-3.2.0/share/virt-manager/virtManager/asyncjob.py", line 65, in cb_wrapper
    callback(asyncjob, *args, **kwargs)
  File "/gnu/store/r9jxh3pv020qa05pza3jiky2vppn68mx-virt-manager-3.2.0/share/virt-manager/virtManager/asyncjob.py", line 101, in tmpcb
    callback(*args, **kwargs)
  File "/gnu/store/r9jxh3pv020qa05pza3jiky2vppn68mx-virt-manager-3.2.0/share/virt-manager/virtManager/object/libvirtobject.py", line 57, in newfn
    ret = fn(self, *args, **kwargs)
  File "/gnu/store/r9jxh3pv020qa05pza3jiky2vppn68mx-virt-manager-3.2.0/share/virt-manager/virtManager/object/domain.py", line 1329, in startup
    self._backend.create()
  File "/gnu/store/7c16ipd35j0fdl6mrjbg3v9zsn8iivi0-python-libvirt-7.9.0/lib/python3.9/site-packages/libvirt.py", line 1353, in create
    raise libvirtError('virDomainCreate() failed')
libvirt.libvirtError: internal error: qemu unexpectedly closed the monitor: 2022-03-13T05:27:57.240470Z qemu-system-x86_64: -device {"driver":"usb-host","hostdevice":"/dev/bus/usb/001/002","id":"hostdev0","bus":"usb.0","port":"6"}: failed to open /dev/bus/usb/001/002: Permission denied

The device that it is trying to access is correct:

$ lsusb -s 001:002
Bus 001 Device 002: ID 04f2:b6dd Chicony Electronics Co., Ltd HD User Facing

The device is owned by root. It seems that read access is not enough for qemu.

$ LC_ALL=C ls -l /dev/bus/usb/001/002
crw-rw-r-- 1 root root 189, 1 Mar 13 06:15 /dev/bus/usb/001/002

My guess is that the device is owned by root for a good security reason. Similarly, virt-manager does not prompt me to run qemu as root. How do I safely manage permissions to allow the guest access the camera? ---------- Another approach, which I initially tried, was to use GNOME Boxes to enable access to the camera device in the respective guest settings. It tries to use SPICE USB redirection, which is similar to what is described in the SPICE user manual , but uses qemu-xhci host adapter instead of ich9-ehci1. However, when I try to flip the switch in the guest settings for the camera device, it just notifies that its redirection failed. Here are the relevant parts in my guest machine configuration, which seem to be OK:

-xml

-xml

---------- So, how can I make the camera available to the guest?