Description of problem:
When I pass a USB device through to a virtual machine, it fails with "Permission denied"

Version-Release number of selected component (if applicable):
virt-manager-0.8.0-7.fc12.noarch
qemu-kvm-0.11.0-12.fc12.x86_64
qemu-system-x86-0.11.0-12.fc12.x86_64
qemu-common-0.11.0-12.fc12.x86_64
selinux-policy-targeted-3.6.32-56.fc12.noarch
selinux-policy-3.6.32-56.fc12.noarch

How reproducible:
Always

Steps to Reproduce:
1.Create VM, passing through USB device
2.Start it
3.
  
Actual results:
No USB device visible in VM.  Error message in /var/log/libvirt/qemu/Win7.log

Expected results:
Passed through device

Additional info:
This looks like a repeat of #504444.

Logged error:

LC_ALL=C PATH=/sbin:/usr/sbin:/bin:/usr/bin QEMU_AUDIO_DRV=none /usr/bin/qemu-kvm -S -M pc-0.11 -m 1024 -smp 1 -name Win7 -uuid 4aa6d565-8c8a-74f9-9730-fe91f2135e14 -monitor unix:/var/lib/libvirt/qemu/Win7.monitor,server,nowait -localtime -boot c -drive file=/var/lib/libvirt/images/Windows7-7100.img,if=ide,index=0,boot=on,format=raw -net nic,macaddr=52:54:00:36:d4:68,vlan=0,model=virtio,name=virtio.0 -net tap,fd=18,vlan=0,name=tap.0 -serial pty -parallel none -usb -usbdevice tablet -vnc 127.0.0.1:1 -vga cirrus -soundhw es1370 -usbdevice host:054c:01c8 
char device redirected to /dev/pts/7
husb: open device 2.3
/dev/bus/usb/002/003: Permission denied
Warning: could not add USB device host:054c:01c8


# ls -lZ /dev/bus/usb/002/003
crw-rw-r--. root root system_u:object_r:usb_device_t:s0 /dev/bus/usb/002/003

I have selinux enforcing, with the following bools set:
# getsebool -a|grep virt
virt_manage_sysfs --> on
virt_use_comm --> off
virt_use_nfs --> off
virt_use_samba --> off
virt_use_usb --> on

If I set the device to 0666:
# chmod 666 /dev/bus/usb/002/003

Then I start getting AVC messages:
# ausearch -m AVC -ts recent
----
time->Mon Dec 21 12:44:02 2009
type=SYSCALL msg=audit(1261428242.145:138): arch=c000003e syscall=2 success=yes exit=128 a0=7fff4c382090 a1=802 a2=7fff4c3820a4 a3=fffffff4 items=0 ppid=1 pid=10517 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=4294967295 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c270,c674 key=(null)
type=AVC msg=audit(1261428242.145:138): avc:  denied  { read write } for  pid=10517 comm="qemu-kvm" name="003" dev=tmpfs ino=302186 scontext=system_u:system_r:svirt_t:s0:c270,c674 tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file
----
time->Mon Dec 21 12:45:24 2009
type=SYSCALL msg=audit(1261428324.533:141): arch=c000003e syscall=2 success=yes exit=128 a0=7fff96828960 a1=802 a2=7fff96828974 a3=fffffff4 items=0 ppid=1 pid=10635 auid=4294967295 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=4294967295 comm="qemu-kvm" exe="/usr/bin/qemu-kvm" subj=system_u:system_r:svirt_t:s0:c102,c592 key=(null)
type=AVC msg=audit(1261428324.533:141): avc:  denied  { read write } for  pid=10635 comm="qemu-kvm" name="003" dev=tmpfs ino=302186 scontext=system_u:system_r:svirt_t:s0:c102,c592 tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file

If I set selinux to permissive, then I can pass the device through (it appears in Windows, but the driver doesn't start up properly; I suspect that's a separate problem).