Comment 3 for bug 1573192

Workaround in focal fossa lts
Example connect my blueray sata device to virtual machine

1) check device channel (in my case channel 2 and device sg5)
root@host:~# lsscsi -g
[2:0:0:0] cd/dvd ASUS BC-12B1ST 1.01 /dev/sr0 /dev/sg5

2) edit the file /etc/apparmor.d/libvirt/TEMPLATE.qemu end add line
owner /dev/sg5 rw,
owner /dev/sg5 k,

example content file /etc/apparmor.d/libvirt/TEMPLATE.qemu
#
# This profile is for the domain whose UUID matches this file.
#

#include <tunables/global>

profile LIBVIRT_TEMPLATE flags=(attach_disconnected) {
  #include <abstractions/libvirt-qemu>
  owner /dev/sg5 rw,
  owner /dev/sg5 k,
}

3) on vm xml add where 2 on value scsi_host2 correspond to previously command lsscsi -g
<controller type='scsi' index='0' model='virtio-scsi'/>
<hostdev mode='subsystem' type='scsi' managed='no' rawio='yes'>
 <source>
  <adapter name='scsi_host2'/>
  <address bus='0' target='0' unit='0'/>
 </source>
</hostdev>