When passthrough USB devices to VMs, spice-client-glib-usb-acl-helper is called to validate usb ACLs via policykit policy