Turns out these more limited permissions are enough:
$ sudo chown root:staff /dev/input/*
$ sudo chmod 660 /dev/input/*
Juanito, devices in /dev/input/ are created with root:root ownership and 640 permissions:
$ ls -l /dev/input
total 0
drwxr-xr-x 2 root root 160 Dec 30 15:32 by-path/
crw-r----- 1 root root 13, 64 Dec 30 15:32 event0
crw-r----- 1 root root 13, 65 Dec 30 15:32 event1
crw-r----- 1 root root 13, 74 Dec 30 15:32 event10
crw-r----- 1 root root 13, 75 Dec 30 15:32 event11
crw-r----- 1 root root 13, 76 Dec 30 15:32 event12
crw-r----- 1 root root 13, 77 Dec 30 15:32 event13
crw-r----- 1 root root 13, 78 Dec 30 15:32 event14
...
I'd like to suggest that we change this to root:staff ownership and 660 permissions, please (I tried root:staff and 640 but that's not enough for gamepad to work--it needs to be root:staff and 660).
This change would have saved me a lot of time and pain, and is sure to help users in the future.
I think it's just a matter of changing this part of /etc/udev/rules.d/50-udev-default.rules from this:
# input
SUBSYSTEM=="input", ENV{ID_INPUT}=="", IMPORT{builtin}="input_id"
KERNEL=="mouse*|mice|event*", MODE="0640"
KERNEL=="ts[0-9]*|uinput", MODE="0644", GROUP="staff"
KERNEL=="js[0-9]*", MODE="0644"
to this
# input
SUBSYSTEM=="input", ENV{ID_INPUT}=="", IMPORT{builtin}="input_id"
KERNEL=="mouse*|mice|event*", MODE="0660", GROUP="staff"
KERNEL=="ts[0-9]*|uinput", MODE="0660", GROUP="staff"
KERNEL=="js[0-9]*", MODE="0660", GROUP="staff"
EDIT: I see that /etc/udev/rules.d/50-udev-default.rules is part of the base system. I'll put in a pull request on Github.