Description of problem:
In this code:

int qemuSetupCgroup(struct qemud_driver *driver,
                    virDomainObjPtr vm)
....
        if (vm->def->nsounds) {
            rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_SND_MAJOR);
            qemuDomainCgroupAudit(vm, cgroup, "allow", "major", "sound",
                                  rc == 0);
            if (rc != 0) {
                virReportSystemError(-rc, "%s",
                                     _("unable to allow /dev/snd/ devices"));
                goto cleanup;
            }
        }


We have granted QEMU access to the host sound devices, regardless of whether the guest XML config needs it. 

We only need to grant access if the graphics type is SDL, or if the graphics type is VNC & vnc_allow_host_audio == 1.

ie, we should be denying access when VNC is used by default, or if SPICE is used.

Version-Release number of selected component (if applicable):
libvirt-0.8.7-6.el6

How reproducible:
Always

Steps to Reproduce:
1. Create a guest with VNC graphics, and  vnc_allow_host_audio == 0
2.
3.
  
Actual results:
Sound devices allowed in cgroups ACL

Expected results:
Sound devices denied.

Additional info: