The GetRngDeviceQuery is being referenced from the user portal, thus it should be a user query.
Seems like it requires further work, so moving it to Frantisek.
Verified in ovirt-engine-3.5.0-0.0.master.20140821064931.gitb794d66.el6.noarch (rc1.1). Before build rc1, when a user for example updated in User Portal a VM with enabled RNG sources, there was error message thrown in engine.log: 2014-07-29 18:32:48,309 ERROR [org.ovirt.engine.core.bll.GetRngDeviceQuery] (ajp--127.0.0.1-8702-1) Query execution failed due to insufficient permissions. In rc1.1, no such message is present any more.
oVirt 3.5 has been released and should include the fix for this issue.