Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use the 'tap' net device with KVM to get my vm connect to the Internet. But I have to be root, or use 'sudo', which is inconvenient. I think I can put my user account into some group so I can access the net device without root privilege. I tried the netdev group, but does not work. My account is already in the kvm group.

What else should I do? Or is there any way to allow me using KVM freely without permission issue?

share|improve this question
up vote 4 down vote accepted

The group is whoever has read and write permissions to /dev/net/tun. The default setup varies from distribution to distribution. The ownership and permissions of devices is set by udev.

Create a file /etc/udev/rules.d/zzz_net_tun.rules containing

KERNEL=="tun", GROUP="netdev", MODE="0660", OPTIONS+="static_node=net/tun"

This will make the device accessible by all users in the netdev group. The setting takes effect when the device is created, so if it already exists, do chgrp netdev /dev/net/tun; chmod 660 /dev/net/tun.

(adapted from the Gentoo Wiki wiki)

share|improve this answer
I tried the last two commands on my Ubuntu 15.04 box but user space applications still can't seem to access it: "qemu-system-arm: -net tap,ifname=tap0: could not configure /dev/net/tun (tap0): Operation not permitted". I verified that the group is set to netdev and permissions set to 0660. (And I'm in the netdev group.) – Nathan Osman Nov 16 '15 at 2:30
@NathanOsman What's the output of groups and ls -l /dev/net/tun? Run strace -o qemu.strace qemu-system-arm net tap,ifname=tap0 … and look at the part of the trace where it tries to open /dev/net/tun. What's going on exactly? If you can't figure it out, ask a new question with all this information. – Gilles Nov 16 '15 at 11:27
I finally decided to just ask a new question anyway: unix.stackexchange.com/q/243382/1049 I'll still run strace and see if I can't get to the bottom of this. – Nathan Osman Nov 16 '15 at 18:42

Make sure you are part of the KVM group also. The recommendantion is to make every virtualization things (network configuration, firmware access, qemu configuration) available for the kvm group.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.