KVM: Device assignment permission checks