-
tun/tap devices are created inside /dev/net by default, so tun[0-9]* and tap[0-9]* doesn't match them. When you run qemu as an unprivileged user, that user must have write permission on the tun device. The group netdev seems to be appropriate for this and it's already included in the baselayout's groups.
bd4d9f02