Comment 4 for bug 1690140

if it really is qemu accessing that as you mentioned to be needed in /etc/apparmor.d/abstractions/libvirt-qemu then very likely instead of just adding one would like to detect the config in the xml with virt-aa-helper and generate the line as needed.

To better understand on top on what I asked before, could you share your full guest xml so I can see if there would be something that virt-aa-helper could learn the path from?