First you should check if it is AppArmor that is blocking your device:
dmesg | grep /dev/sg0
If you see a message similar to:
[159883.682167] audit: type=1400 audit(1534114680.047:392): apparmor="DENIED" operation="file_lock" profile="libvirt-40d3ad0d-0574-4823-ae7d-eaf38afa7fb6" name="/dev/sg0"
Then it is being locked by AppArmor. If the profile field looks like above with the domain's identifier located after
profile= portion then it is a dynamically created profile created by KVM after the domain starts as part of KVM's integration with AppArmor.
You can allow access to some or all your SCSI devices for your KVM hosts by editing the template file usually located at
/etc/apparmor.d/libvirt. You should see A
TEMPLATE.qemu file which is used as the basis for the dynamically created AppArmor profiles. You can whitelist the device(s) in this file or edit the file pointed at by the include listed in the template file which is usually
/etc/apparmor.d/abstractions/libvirt-qemu. To whitelist, just add your entries on their own lines to the file like so:
If you are using the GUI to edit the SCSI devices in the domain, you may notice that the devices don't show up correctly in the GUI. For example, if you are trying to pass through an optical drive it may not show that media is in the drive even if some is present. You will want to whilelist these devices to the KVM service as well by adding similar entries to the
/etc/apparmor.d/usr.lib.libvirt.virt-aa-helper file and then tell AppArmor to reload configs:
service apparmor reload
If the SCSI devices are symlinked, you may need to add those symlinked devices to your whitelist as well. The AppArmor errors will let you know if this is the case as you will see updated errors as you whitelist devices for read or write if you don't have them all covered.