Interesting. For me, it’s only the /dev/dri/render*
device that is owned by the render
group, but this device is world-RW anyway. Still, I guess you can add the user to the render
group too? I did find some info that Debian uses that group this way, though I have never used Debian myself, so can’t verify that.
No idea then :( AFAIK the logind mechanism I mentioned originally is based only on permissions, but I had never really needed to look into it further.