Description of problem: When I attempt to create a snapshot in virsh on a machine with a second disk with a mysql instance on that mount point, the snapshot fails and the error message references the mount point of the second disk.  SELinux audit2allow shows missing capabilities for the qemu guest agent type.

Version-Release number of selected component (if applicable): EL 7.6; qemu-guest-agent.x86_64 - 10:2.12.0-2.el7

How reproducible: Every time

Steps to Reproduce:
1. On the host, install the qemu-ev repo and qemu-kvm-ev on top of qemu-kvm (so snapshot-create works)
2. Create a guest machine with a min install and qemu guest agent
3. Add a second disk on the host with qemu-img create and virsh attach-disk to the guest.
4. On the guest, format and mount the disk to /var/lib/mysql
5. On the guest, install Mysql (I used 5.7) and run it (this problem doesn't happen when the second disk is empty as a pure test) also note you'll need to add ignore-db-dir=lost+found to the [mysqld] section of the config file before your first run or mysql environment will refuse to manifest in the non-empty directory.
6. On the host in virsh, run a: snapshot-create-as <DOMAIN_NAME> test.snap --disk-only --quiesce --atomic

Actual results: error: internal error: unable to execute QEMU agent command 'guest-fsfreeze-freeze': failed to open /var/lib/mysql: Permission denied

audit2allow -a shows:
#============= virt_qemu_ga_t ==============
allow virt_qemu_ga_t self:capability { dac_override dac_read_search };

Expected results: Successful creation of snapshot

Additional info: Workarounds are to allow virt_qemu_ga_t to run in permissive mode while working with the snapped machine.  Also could add custom policy to address this, but I believe the production policy for this type is incomplete.  This was done on a CentOS 7.6 VM running on a CentOS 7.6 host, but I don't think the results on RHEL will be different.