Comment 3 for bug 1620407

Hi,
sorry for the Delay, I got subscribed by a Friend yesterday to look into it but never saw the bug before.

The spec of all of this is at https://libvirt.org/formatdomain.html#elementsNICSEthernet and the default handling script for that usually is /etc/qemu-ifup

I tested on Xenial (libvirt 1.3) as well as on Zesty (libvirt 2.5) by setting the path explicitly to the default script.
It then looks like:

    <interface type='ethernet'>
      <mac address='52:54:00:18:0d:a3'/>
      <script path='/etc/qemu-ifup'/>
      <target dev='mf_testet'/>
      <model type='virtio'/>
      <alias name='net1'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
    </interface>

That just worked fine on libvirt 2.5 for me.
The guest device shows up as ens7 just as it should (pic slot 7) and no error when starting the guest.

On libvirt 1.3 I got:
error: Failed to start domain testguest-X-on-X
error: Unable to get index for interface mf_testet: No such device

I think you only specify that if that is for an existing device your script shall use, you can drop the "target" statement and get further.

Now I see:
error: internal error: process exited while connecting to monitor: 2017-01-12T13:14:56.978535Z qemu-system-x86_64: -netdev tap,script=/etc/qemu-ifup,id=hostnet1,vhost=on,vhostfd=29: could not open /dev/net/tun: Operation not permitted

Here it rang a bell - IIRC That is kind of ok.
If I remember correctly there was quite a lot of default security that you had to drop to get ethernet type networking.
There is some help of this being known at http://wiki.libvirt.org/page/Troubleshooting under "Guest_won't_start_-_warning:_could_not_open_/dev/net/tun"
As well as (other distro but same applies) https://fedoraproject.org/wiki/How_to_debug_Virtualization_problems?rd=Tools/Virtualization/BugReporting#Errors_using_.3Cinterface_type.3D.27ethernet.27.2F.3E

I'll set the bug to incomplete for now until you provide more info.
ATM I'm not so sure this is a real bug or more a combination of default security features blocking you from this less recommended way.
Also did this work on a former version?