I give it session-bus access so that we can connect to a Qemu instance that was started on the user session. Not needed for "real" apps.