Comment 12 for bug 1276719

Sorry, I only just noticed that you were using qemu:commandline sections to add the vfio devices. This prevents virt-aa-helper from knowing that you need the /dev/vfio/* permissions. Please take a look at http://libvirt.org/formatdomain.html, searching for all occurances of 'vfio', for more information.