What were you trying to do that didn't work?

Set rawio='no' in vm xml for scsi hostdev, then start vm and check the sg_raw command. The sg_raw command is not forbidden as expected.

What is the impact of this issue to you?

Please provide the package NVR for which the bug is seen:

libvirt-10.8.0-2.el9.x86_64
qemu-kvm-9.1.0-1.el9.mrezanin202409260323.x86_64

How reproducible is this bug?:

100%

Steps to reproduce

1. Prepare iscsi storage
2. Passthrough the iscsi lun to vm with rawio capability disabled:

   # virsh dumpxml vm1 --xpath //hostdev
       <hostdev mode='subsystem' type='scsi' managed='no' sgio='filtered' rawio='no'>
         <source>
           <adapter name='scsi_host15'/>
           <address bus='0' target='0' unit='0'/>
         </source>
         <alias name='hostdev0'/>
         <address type='drive' controller='0' bus='0' target='0' unit='0'/>
       </hostdev>
   # virsh start vm1
   

3.  Login vm, check sg_raw command:

   [root@localhost ~]# sg_raw -v -r40 /dev/sdb eb 01 00 00 00 00 00 00 >
       cdb to send: [eb 01 00 00 00 00 00 00 28 00]
   SCSI Status: Check Condition 
   
   Sense Information:
   Fixed format, current; Sense key: Illegal Request
   Additional sense: Invalid command operation code
    Raw sense data (in hex), sb_len=18, calculated_len=18
           70 00 05 00 00 00 00 0a  00 00 00 00 20 00 00 00
           00 00
   
   Error 9 occurred, no data received
   Illegal request, Invalid opcode
   

Expected results

When rawio is disabled, the output of sg_raw command should be("Aborted Command"):

[root@localhost ~]# sg_raw -v -r40 /dev/sdb eb 01 00 00 00 00 00 00 28 00    
    cdb to send: [eb 01 00 00 00 00 00 00 28 00]
SCSI Status: Check Condition 

Sense Information:
Fixed format, current; Sense key: *Aborted Command*
Additional sense: I/O process terminated
 Raw sense data (in hex), sb_len=18, calculated_len=18
        70 00 0b 00 00 00 00 0a  00 00 00 00 00 06 00 00
        00 00

Error 11 occurred, no data received
Aborted command

Actual results

Additional info

Check process caps on host, it didn't include the rawio cap:
[root@dell-per740-78 ~]# getpcaps `pidof qemu-kvm`
73407: =