auditd can find those acl setters :) # auditctl -w /dev/kvm -p a -k kvm-acl-setter-foo Later on: # ausearch -k kvm-acl-setter-foo