auditd can find those acl setters :) # auditctl -w /dev/kvm -p a -k kvm-acl-setter-foo
Later on: # ausearch -k kvm-acl-setter-foo
pgpDrrFvZJqO9.pgp
Description: OpenPGP digital signature
auditd can find those acl setters :) # auditctl -w /dev/kvm -p a -k kvm-acl-setter-foo
Later on: # ausearch -k kvm-acl-setter-foo
pgpDrrFvZJqO9.pgp
Description: OpenPGP digital signature