Comment 3 for bug 1690140

The reasoning for the last one to "go in" was that is a somewhat official location guided by the libvirt docu at https://wiki.libvirt.org/page/VNCTLSSetup.

Could you please outline which man-page/guid/howto you are following that makes that default directory to be /etc/pki/libvirt-spice?

Also could you please share your dmesg so that we see what apparmor DENIES you have there?

Until it was decided if this is a path that will be picked up by upstream and/or Ubuntu packaging you should be able to add it as a local override to be fine. After all any sort of local configs extra need is just what they are meant for.
The file to add those likely is /etc/apparmor.d/local/usr.sbin.libvirtd but since I didn't see the Deny you face yet it might be different (Depends on which process tries to access that).