The 'linux-sgx' package is adding host software  needed to support Intel TDX confidential virtualization. The most important piece in this package is the 'qgs' daemon which provides an attestation service. QEMU will speak to 'qgs' over a UNIX domain socket when the guest OS requests attestation of the VM.

Given that QEMU is a strictly confined daemon under SELinux Policy, we need to define a new 'qgs_t' SELinux domain, write suitable access rules, and permit the 'svirt_t' domain to communicate with it.

Without a QGS policy, the current default QEMU svirt_t policy will block access to QGS, so this will be a blocker for shipping TDX support in RHEL.