My solution was to restrict access to those devices to those using
the console of the machine.  I used ttyaction(5) and xdm's
xdm-config(5) to invoke the GiveConsole and TakeConsole scripts to
chown and chmod the appropriate devices (/dev/{fd*,cd*,audio*,tty0*,usb*})
and mount points to the console user.

Brian.

-- 
     Brian de Alwis | Graduate student | Software Practices Lab | UBC
"There is much pleasure to be gained in useless knowledge." - Bertrand Russell