Description of problem:
As subject

Version-Release number of selected component (if applicable):
qemu-kvm-7.2.0-2.el9.x86_64
kernel-5.14.0-207.el9.x86_64
libvirt-8.10.0-2.el9.x86_64

How reproducible:

Steps to Reproduce:
1. Start an VM
➜ ~ virsh list
Id Name State
--------------------------
4 rhel-9.2 running

2. Attach an disk with rawio='yes' then check the capabilities of the qemu-kvm process and its threads
➜ ~ virsh attach-device rhel-9.2 ./rawio.xml
Device attached successfully

➜ ~ cat rawio.xml
<disk type='block' device='lun' rawio='yes'>
<driver name='qemu' type='raw'/>
<source dev='/dev/sda'/>
<target dev='sda' bus='scsi'/>
<address type='drive' controller='0' bus='0' target='0' unit='0'/>
</disk>

➜ ~ getpcaps `pidof qemu-kvm`
439898: =

➜ ~ for i in $(ps -T -p `pidof qemu-kvm`|awk 'NR!=1

{print $2}');do getpcaps $i;done
439898: =
439917: =
439921: =
439922: =
439924: =

Actual results:
As above

Expected results:
- Disallow hot-plug with rawio='yes'
- Or support to set/unset the RAWIO capabilities for qemu-kvm process or its threads. Expect the results like starting VM with rawio='yes':
➜ ~ getpcaps `pidof qemu-kvm`
440300: cap_sys_rawio=eip

➜ ~ for i in $(ps -T -p `pidof qemu-kvm`|awk 'NR!=1{print $2}

');do getpcaps $i;done
440300: cap_sys_rawio=eip
440315: cap_sys_rawio=eip
440319: cap_sys_rawio=eip
440320: cap_sys_rawio=eip
440323: cap_sys_rawio=eip

Additional info: