With Fedora20 and built from sources qemu-2.1.1, I'm experiencing issues to run qemu with non-root privileges:

% qemu-system-x86_64 -hda vdisk.img -m 512M -netdev tap,helper=/usr/libexec/qemu-bridge-helper,id=net0 -device e1000,netdev=net0
failed to create tun device: Operation not permitted
failed to launch bridge helper
qemu-system-x86_64: -netdev tap,helper=/usr/libexec/qemu-bridge-helper,id=net0: Device 'tap' could not be initialized

Tun device has proper permissions:

% ls -la /dev/net/tun
crw-rw-rw- 1 root root 10, 200 Sep 30 09:22 /dev/net/tun

qemu-bridge-helper has suid bit enabled, SELinux is disabled ('getenforce' returns Disabled). Whatever else am I missing?

  • Try the qemu in your package manager and remove the source... – eyoung100 Oct 1 '14 at 1:35
  • Maybe raw sockets require a privilege as well? strace -f to see where qemu fails. setcap cap_net_raw+ep -- "$(which qemu-system-x86_64)" should give you that privilege, if that's the problem. – Tobu Sep 20 '15 at 13:08

That's the way the cookie crumbles with QEMU. If you read the documentation you'll get to:


The tap networking backend makes use of a tap networking device in the host. It offers very good performance and can be configured to create virtually any type of network topology. Unfortunately, it requires configuration of that network topology in the host which tends to be different depending on the operating system you are using. Generally speaking, it also requires that you have root privileges.

Running QEMU as a user gives you a simplified networking. According to a WikiBooks article

If no network options are specified, QEMU will default to emulating a single Intel e1000 PCI card with a user-mode network stack that bridges to the host's network. The following three command lines are equivalent:

qemu -m 256 -hda disk.img &
qemu -m 256 -hda disk.img -net nic -net user &
qemu-system-i386 -m 256 -hda disk.img -netdev user,id=network0 -device e1000,netdev=network0 &

The -net option is superceded by -netdev in newer QEMU versions.

The guest OS will see an E1000 NIC with a virtual DHCP server on and will be allocated an address starting from A virtual DNS server will be accessible on, and a virtual SAMBA file server (if present) will be accessible on allowing you to access files on the host via SAMBA file shares.

User mode networking is great for allowing access to network resources, including the Internet. By default, however, it acts as a firewall and does not permit any incoming traffic. It also doesn't support protocols other than TCP and UDP - so, for example, ping and other ICMP utilities won't work.

  • so according to wiki.qemu.org/Documentation/Networking#Tap I have not chance to launch qemu with non-root account? Hm, ok.. – Mark Oct 2 '14 at 1:41
  • 1
    You can run qemu as an user, but it will be quite restricted. You could (depending on your situation) set up sudo to allow qemu to run without a password. – garethTheRed Oct 2 '14 at 6:14
  • however when running qemu as a non-privileged user, it is not able to configure tap interface, no matter what permission I set on /dev/net/tun So my conclusion is that I must run qemu as root if I need TAP functionality. – Mark Oct 2 '14 at 11:50
  • You can run qemu as a unprivileged user by having qemu drop permissions via -runas user or by creating a tap device that is owned by the unprivileged user. ip-tuntap(8) can assign ownership of tuns/taps. among other ways. – llua Dec 5 '15 at 4:58

Check the output of:

ls -l /dev/kvm

Look at the user-permissions segment, looks something like user group

Make sure your user has access to /dev/kvm

chown your_user:your_group /dev/kvm

Then you can run VMs from your user!

  • 1
    I don't have troubles with /dev/kvm, permissions on kvm device are correct. The problem occurs when qemu, specifically qemu-bridge-helper attempts to fiddle with tap0 device. – Mark Oct 2 '14 at 1:39

On my machine I could solve the problem by setting user-ID bit on execution on the "qemu-bridge-helper":

sudo chmod u+s /usr/lib/qemu-bridge-helper
ls -la /usr/lib/qemu-bridge-helper 
-rwsr-xr-x 1 root root 14336 Dez 16 15:36 /usr/lib/qemu-bridge-helper

I'm on Fedora 21, but maybe it was already available on Fedora 20

There is a new way to give option to setup bridge connection, which is :

qemu-system-x86_64 -hda vdisk.img -m 512M -netdev bridge,id=net0,br=qemubr0 -device e1000,netdev=net0

You don't have to set helper=/usr/libexec/qemu-bridge-helper, it seems the default

And you have to make sure when using the default helper you have the file /etc/qemu/bridge.conf with the bridge you intend to use

allow qemubr0 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.