diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index 5f4519dc9994c6de11ae8091903876070fd6b911..95906e68a38216a9d3dac26421a9d9e3c907f1d8 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -1149,11 +1149,11 @@ get_files(vahControl * ctl)
         }
     }
     if (needsvhost)
-        virBufferAddLit(&buf, "  /dev/vhost-net rw,\n");
+        virBufferAddLit(&buf, "  \"/dev/vhost-net\" rw,\n");
 
     if (needsVfio) {
-        virBufferAddLit(&buf, "  /dev/vfio/vfio rw,\n");
-        virBufferAddLit(&buf, "  /dev/vfio/[0-9]* rw,\n");
+        virBufferAddLit(&buf, "  \"/dev/vfio/vfio\" rw,\n");
+        virBufferAddLit(&buf, "  \"/dev/vfio/[0-9]*\" rw,\n");
     }
 
     if (ctl->newfile)