qemu: only request sound cgroup ACL when required

When a SPICE or VNC graphics controller is present, and sound is
piggybacked over a channel to the graphics device rather than
directly accessing host hardware, then there is no need to grant
host hardware access to that qemu process.

* src/qemu/qemu_cgroup.c (qemuSetupCgroup): Prevent sound with
spice, and with vnc when vnc_allow_host_audio is 0.
Reported by Daniel Berrange.

src/qemu/qemu_cgroup.c

@@ -241,7 +241,11 @@ int qemuSetupCgroup(struct qemud_driver *driver,
             goto cleanup;
         }
 
-        if (vm->def->nsounds) {
+        if (vm->def->nsounds &&
+            (!vm->def->ngraphics ||
+             ((vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC &&
+               driver->vncAllowHostAudio) ||
+              (vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL)))) {
             rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_SND_MAJOR);
             qemuDomainCgroupAudit(vm, cgroup, "allow", "major", "sound",
                                   rc == 0);