SUBSYSTEM=="vc", KERNEL=="vcs*|vcsa*", GROUP="tty", SECLABEL{smack}="*"
KERNEL=="tty[A-Z]*[0-9]|pppox[0-9]*|ircomm[0-9]*|noz[0-9]*|rfcomm[0-9]*", GROUP="dialout", SECLABEL{smack}="*"
-SUBSYSTEM=="input", KERNEL=="mouse*|mice|event*", GROUP="input", SECLABEL{smack}="*"
-SUBSYSTEM=="input", KERNEL=="ts[0-9]*|uinput", GROUP="input", SECLABEL{smack}="*"
+SUBSYSTEM=="input", KERNEL=="mouse*|mice|event*|ts[0-9]*|uinput", GROUP="input", SECLABEL{smack}="*", RUN+="/usr/bin/setfacl -m group:priv_keygrab:r %N"