add custom permission

In my application the user can choose an avatar from a gallery and also upload a custom avatar.
Now I want to implement a feature in the ACP which allows the administrator to grant / revoke permission for a certain user group to upload a custom avatar.
I was thinking about extending the user group permissions, but I am not sure if this is the right approach.