If you setup spice, xdm_t seems to be using the virtio device

diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index 0ad8e41b0c3e2b25f8d0fb22c031a4a4a9ee4fcb..d293052067dadb40c0bb93ab54c5c04f310f9e32 100644 (file)
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -633,6 +633,7 @@ storage_dontaudit_rw_fuse(xdm_t)
 
 term_setattr_console(xdm_t)
 term_use_console(xdm_t)
+term_use_virtio_console(xdm_t)
 term_use_unallocated_ttys(xdm_t)
 term_setattr_unallocated_ttys(xdm_t)
 term_relabel_all_ttys(xdm_t)