Description of problem:
As subject

Version-Release number of selected component (if applicable):
kernel-5.14.0-152.el9.x86_64
selinux-policy-34.1.40-1.el9.noarch
libvirt-8.5.0-5.el9.x86_64
qemu-kvm-7.0.0-11.el9.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Prepare a host with a NVME disk
2. Attach the disk to the running VM
➜  ~ virsh list 
 Id   Name   State
----------------------
 3    rhel   running

➜  ~ cat nvme.xml 
  <disk type='nvme' device='disk'>
    <driver name='qemu' type='raw'/>
    <source type='pci' managed='yes' namespace='1'>
      <address domain='0x0000' bus='0x87' slot='0x00' function='0x0'/>
    </source>
    <target dev='vdb' bus='virtio'/>
  </disk>


➜  ~ virsh attach-device rhel nvme.xml
error: Failed to attach device from nvme.xml
error: internal error: unable to execute QEMU command 'blockdev-add': Failed to open VFIO group file: /dev/vfio/54: Permission denied

The selinux denial message:
Aug 25 05:49:36 dell-per730-37 setroubleshoot[2455]: SELinux is preventing /usr/libexec/qemu-kvm from 'read, write' accesses on the chr_file 54. For complete SELinux messages run: sealert -l 34557985-d3f4-42e4-a4f6-8e1e2a3611ce
Aug 25 05:49:36 dell-per730-37 setroubleshoot[2455]: SELinux is preventing /usr/libexec/qemu-kvm from 'read, write' accesses on the chr_file 54.#012#012*****  Plugin device (91.4 confidence) suggests   ****************************#012#012If you want to allow qemu-kvm to have read write access on the 54 chr_file#012Then you need to change the label on 54 to a type of a similar device.#012Do#012# semanage fcontext -a -t SIMILAR_TYPE '54'#012# restorecon -v '54'#012#012*****  Plugin catchall (9.59 confidence) suggests   **************************#012#012If you believe that qemu-kvm should be allowed read write access on the 54 chr_file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'qemu-kvm' --raw | audit2allow -M my-qemukvm#012# semodule -X 300 -i my-qemukvm.pp#012

Actual results:
As above

Expected results:
No selinux denial

Additional info:
1. The test could pass when selinux is permissive.
2. VM could start with a NVME disk
3. The details from selaert:
➜  ~ sealert -l 34557985-d3f4-42e4-a4f6-8e1e2a3611ce                
SELinux is preventing /usr/libexec/qemu-kvm from 'read, write' accesses on the chr_file 54.
                                                                               
*****  Plugin device (91.4 confidence) suggests   ****************************
                                       
If you want to allow qemu-kvm to have read write access on the 54 chr_file
Then you need to change the label on 54 to a type of a similar device.
Do                                                                             
# semanage fcontext -a -t SIMILAR_TYPE '54'
# restorecon -v '54'
                                                                                                                                                               *****  Plugin catchall (9.59 confidence) suggests   **************************                                                                                 

If you believe that qemu-kvm should be allowed read write access on the 54 chr_file by default.
Then you should report this as a bug.                                                                                                                          You can generate a local policy module to allow this access.                                                                                                   Do                                                                             
allow this access for now by executing: 
# ausearch -c 'qemu-kvm' --raw | audit2allow -M my-qemukvm
# semodule -X 300 -i my-qemukvm.pp
                                       

Additional Information:
Source Context                system_u:system_r:svirt_t:s0:c5,c897
Target Context                system_u:object_r:device_t:s0
Target Objects                54 [ chr_file ]
Source                        qemu-kvm
Source Path                   /usr/libexec/qemu-kvm
Port                          <Unknown> 
Host                          dell-per730-37.lab.eng.pek2.redhat.com
Source RPM Packages           qemu-kvm-core-7.0.0-11.el9.x86_64
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-34.1.40-1.el9.noarch
Local Policy RPM              selinux-policy-targeted-34.1.40-1.el9.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing 
Host Name                     XXXX
Platform                      Linux XXXX
                              5.14.0-152.el9.x86_64 #1 SMP PREEMPT_DYNAMIC Mon
                              Aug 22 20:01:02 EDT 2022 x86_64 x86_64
Alert Count                   1
First Seen                    2022-08-25 05:49:32 EDT
Last Seen                     2022-08-25 05:49:32 EDT
Local ID                      34557985-d3f4-42e4-a4f6-8e1e2a3611ce

Raw Audit Messages
type=AVC msg=audit(1661420972.879:176): avc:  denied  { read write } for  pid=2382 comm="qemu-kvm" name="54" dev="tmpfs" ino=15 scontext=system_u:system_r:svir
t_t:s0:c5,c897 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=0


type=SYSCALL msg=audit(1661420972.879:176): arch=x86_64 syscall=openat success=no exit=EACCES a0=ffffff9c a1=55ee511f8960 a2=2 a3=0 items=0 ppid=1 pid=2382 aui
d=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=4294967295 comm=qemu-kvm exe=/usr/libexec/qemu-kvm subj=sys
tem_u:system_r:svirt_t:s0:c5,c897 key=(null)

Hash: qemu-kvm,svirt_t,device_t,chr_file,read,write