diff -ur libvirt-6.1.0.orig/src/qemu/qemu.conf libvirt-6.1.0/src/qemu/qemu.conf
--- libvirt-6.1.0.orig/src/qemu/qemu.conf	2020-03-06 09:49:35.413000000 +0100
+++ libvirt-6.1.0/src/qemu/qemu.conf	2020-03-06 09:50:04.229000000 +0100
@@ -141,6 +141,15 @@
 #vnc_sasl = 1
 
 
+# Enable the VNC access control lists. When switched on this will
+# initially block all vnc users from accessing the vnc server. To
+# add and remove ids from the ACLs you will need to send the appropriate
+# commands to the qemu monitor as required by your particular version of
+# QEMU. See the QEMU documentation for more details.
+# 
+# vnc_acl = 1
+
+
 # The default SASL configuration file is located in /etc/sasl/
 # When running libvirtd unprivileged, it may be desirable to
 # override the configs in this location. Set this parameter to
diff -ur libvirt-6.1.0.orig/src/qemu/qemu_command.c libvirt-6.1.0/src/qemu/qemu_command.c
--- libvirt-6.1.0.orig/src/qemu/qemu_command.c	2020-03-06 09:49:35.413000000 +0100
+++ libvirt-6.1.0/src/qemu/qemu_command.c	2020-03-06 09:50:04.230000000 +0100
@@ -7569,6 +7569,10 @@
             virCommandAddEnvPair(cmd, "SASL_CONF_PATH", cfg->vncSASLdir);
 
         /* TODO: Support ACLs later */
+
+        if (cfg->vncACL)
+           virBufferAddLit(&opt, ",acl");
+
     }
 
     virCommandAddArg(cmd, "-vnc");
diff -ur libvirt-6.1.0.orig/src/qemu/qemu_conf.c libvirt-6.1.0/src/qemu/qemu_conf.c
--- libvirt-6.1.0.orig/src/qemu/qemu_conf.c	2020-03-06 09:49:35.410000000 +0100
+++ libvirt-6.1.0/src/qemu/qemu_conf.c	2020-03-06 09:50:04.230000000 +0100
@@ -428,6 +428,8 @@
         return -1;
     if (virConfGetValueBool(conf, "vnc_allow_host_audio", &cfg->vncAllowHostAudio) < 0)
         return -1;
+    if (virConfGetValueBool(conf, "vnc_acl", &cfg->vncACL) < 0)
+        return -1;
 
     return 0;
 }
diff -ur libvirt-6.1.0.orig/src/qemu/qemu_conf.h libvirt-6.1.0/src/qemu/qemu_conf.h
--- libvirt-6.1.0.orig/src/qemu/qemu_conf.h	2020-03-06 09:49:35.409000000 +0100
+++ libvirt-6.1.0/src/qemu/qemu_conf.h	2020-03-06 09:50:04.230000000 +0100
@@ -118,6 +118,7 @@
     bool vncTLSx509verify;
     bool vncTLSx509verifyPresent;
     bool vncSASL;
+    bool vncACL;
     char *vncTLSx509certdir;
     char *vncTLSx509secretUUID;
     char *vncListen;