Comment 3 for bug 1675343

Confirmed /dev/net/tun is not part of the cgroup_device_acl on Ubuntu either.

I think most deployment tooling is actually writing out a revised qemu.conf with the right values -for example:

  https://github.com/openstack/charm-nova-compute/blob/master/templates/qemu.conf