...
- a "description":
Free text to describe the rule - a "command"
- "always": always assign the device (or all if unspecified) to the vm (or dom0 none if unspecified), implies "allow"
- "allow": allow the device (or all if unspecified) to be passed to the vm (or all if unspecified)
- "deny": deny the device (or all if unspecified) to be passed to the vm (or all if unspecified)
- a "device"
See below for sub-nodes - a "vm"
For now, the only valid sub-node is "uuid", to specify the UUID of the VM
...