diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 22dde5a603fae46c4ce1b6c9db4fcd206bc75c34..b0dfcfba13b27306e6643299468780bcb3064512 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -1059,6 +1059,7 @@ virCgroupGetCpuCfsQuota;
 virCgroupGetCpusetCpus;
 virCgroupGetCpusetMems;
 virCgroupGetCpuShares;
+virCgroupGetDevicePermsString;
 virCgroupGetDomainTotalCpuStats;
 virCgroupGetFreezerState;
 virCgroupGetMemoryHardLimit;
diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c
index c578bd08c17fd87bb88ccf0f18ef9d64fa8b7396..2eaf26592c449829be8fe22db4dbcbc1df59aa8a 100644
--- a/src/util/vircgroup.c
+++ b/src/util/vircgroup.c
@@ -2623,6 +2623,44 @@ virCgroupDenyAllDevices(virCgroupPtr group)
 }
 
 
+/**
+ * virCgroupGetDevicePermsString:
+ *
+ * @perms: Bitwise or of VIR_CGROUP_DEVICE permission bits
+ *
+ * Returns string corresponding to the appropriate bits set.
+ */
+const char *
+virCgroupGetDevicePermsString(int perms)
+{
+    if (perms & VIR_CGROUP_DEVICE_READ) {
+        if (perms & VIR_CGROUP_DEVICE_WRITE) {
+            if (perms & VIR_CGROUP_DEVICE_MKNOD)
+                return "rwm";
+            else
+                return "rw";
+        } else {
+            if (perms & VIR_CGROUP_DEVICE_MKNOD)
+                return "rm";
+            else
+                return "r";
+        }
+    } else {
+        if (perms & VIR_CGROUP_DEVICE_WRITE) {
+            if (perms & VIR_CGROUP_DEVICE_MKNOD)
+                return "wm";
+            else
+                return "w";
+        } else {
+            if (perms & VIR_CGROUP_DEVICE_MKNOD)
+                return "m";
+            else
+                return "";
+        }
+    }
+}
+
+
 /**
  * virCgroupAllowDevice:
  *
@@ -2641,10 +2679,8 @@ virCgroupAllowDevice(virCgroupPtr group, char type, int major, int minor,
     int ret = -1;
     char *devstr = NULL;
 
-    if (virAsprintf(&devstr, "%c %i:%i %s%s%s", type, major, minor,
-                    perms & VIR_CGROUP_DEVICE_READ ? "r" : "",
-                    perms & VIR_CGROUP_DEVICE_WRITE ? "w" : "",
-                    perms & VIR_CGROUP_DEVICE_MKNOD ? "m" : "") < 0)
+    if (virAsprintf(&devstr, "%c %i:%i %s", type, major, minor,
+                    virCgroupGetDevicePermsString(perms)) < 0)
         goto cleanup;
 
     if (virCgroupSetValueStr(group,
@@ -2678,10 +2714,8 @@ virCgroupAllowDeviceMajor(virCgroupPtr group, char type, int major,
     int ret = -1;
     char *devstr = NULL;
 
-    if (virAsprintf(&devstr, "%c %i:* %s%s%s", type, major,
-                    perms & VIR_CGROUP_DEVICE_READ ? "r" : "",
-                    perms & VIR_CGROUP_DEVICE_WRITE ? "w" : "",
-                    perms & VIR_CGROUP_DEVICE_MKNOD ? "m" : "") < 0)
+    if (virAsprintf(&devstr, "%c %i:* %s", type, major,
+                    virCgroupGetDevicePermsString(perms)) < 0)
         goto cleanup;
 
     if (virCgroupSetValueStr(group,
@@ -2752,10 +2786,8 @@ virCgroupDenyDevice(virCgroupPtr group, char type, int major, int minor,
     int ret = -1;
     char *devstr = NULL;
 
-    if (virAsprintf(&devstr, "%c %i:%i %s%s%s", type, major, minor,
-                    perms & VIR_CGROUP_DEVICE_READ ? "r" : "",
-                    perms & VIR_CGROUP_DEVICE_WRITE ? "w" : "",
-                    perms & VIR_CGROUP_DEVICE_MKNOD ? "m" : "") < 0)
+    if (virAsprintf(&devstr, "%c %i:%i %s", type, major, minor,
+                    virCgroupGetDevicePermsString(perms)) < 0)
         goto cleanup;
 
     if (virCgroupSetValueStr(group,
@@ -2789,10 +2821,8 @@ virCgroupDenyDeviceMajor(virCgroupPtr group, char type, int major,
     int ret = -1;
     char *devstr = NULL;
 
-    if (virAsprintf(&devstr, "%c %i:* %s%s%s", type, major,
-                    perms & VIR_CGROUP_DEVICE_READ ? "r" : "",
-                    perms & VIR_CGROUP_DEVICE_WRITE ? "w" : "",
-                    perms & VIR_CGROUP_DEVICE_MKNOD ? "m" : "") < 0)
+    if (virAsprintf(&devstr, "%c %i:* %s", type, major,
+                    virCgroupGetDevicePermsString(perms)) < 0)
         goto cleanup;
 
     if (virCgroupSetValueStr(group,
diff --git a/src/util/vircgroup.h b/src/util/vircgroup.h
index 7bb46bf5028583a92841a0edf1d09b168bc0e932..3ab9f1c46138087354a656a7f9ffc5eed18be946 100644
--- a/src/util/vircgroup.h
+++ b/src/util/vircgroup.h
@@ -173,6 +173,8 @@ enum {
     VIR_CGROUP_DEVICE_RWM   = VIR_CGROUP_DEVICE_RW | VIR_CGROUP_DEVICE_MKNOD,
 };
 
+const char *virCgroupGetDevicePermsString(int perms);
+
 int virCgroupDenyAllDevices(virCgroupPtr group);
 
 int virCgroupAllowDevice(virCgroupPtr group,