It happens whether SELinux is Permissive or Enforcing, so it
does not seem to be an SELinux problem.

Created attachment 945552 [details]
libvirtd.log from failure (xz-compressed)

The relevant bit seems to be:

2014-10-10 10:34:15.367+0000: 6839: error : qemuCreateInBridgePortWithHelper:267 : failed to retrieve file descriptor for interface: Permission denied
2014-10-10 10:34:15.368+0000: 6839: debug : virProcessAbort:104 : aborting child process 6974

To give it a bit more context:

2014-10-10 10:34:15.328+0000: 6839: debug : virCommandRunAsync:2265 : About to r
un /usr/libexec/qemu-bridge-helper --use-vnet --br=virbr0 --fd=23
2014-10-10 10:34:15.332+0000: 6839: debug : virFileClose:90 : Closed fd 24
2014-10-10 10:34:15.332+0000: 6839: debug : virCommandRunAsync:2270 : Command re
sult 0, with PID 6974
2014-10-10 10:34:15.332+0000: 6839: debug : virFileClose:90 : Closed fd 23
2014-10-10 10:34:15.367+0000: 6839: error : qemuCreateInBridgePortWithHelper:267 : failed to retrieve file descriptor for interface: Permission denied

$ ll /usr/libexec/qemu-bridge-helper 
-rwsr-xr-x. 1 root root 15344 Sep 26 16:10 /usr/libexec/qemu-bridge-helper

Why would this fail?

The libvirt bug here is that libvirt hides the underlying
error from qemu-bridge helper.

The underlying error is:

$ /usr/libexec/qemu-bridge-helper --use-vnet --br=virbr0 --fd=1
failed to open /dev/net/tun: Permission denied
$ ll /dev/net/tun 
crw-------. 1 root root 10, 200 Oct 10 10:09 /dev/net/tun

I've not changed the permissions on this file.  The expected
permissions are 0666.

The timestamp on the file is the same (to the nearest second)
as an update of systemd, according to /var/log/yum.log

Oct 10 10:09:21 Updated: systemd-208-22.fc20.x86_64

The permissions thing is probably
https://bugzilla.redhat.com/show_bug.cgi?id=1139034

The same happens with me, except my /dev/net/tun has the expected 0666 rights. I failed to produce any logs so far, but I’m on it (any pointers on how to do it are appreciated). The machine was created with GNOME Boxes. If I change the interface to 'user' instead of 'bridge', I can start it with

$ virsh start testrunner

with interface type 'bridge' I get

error: failed to retrieve file descriptor for interface: Permission denied

Some additional information:

SELinux is enabled and enforcing. No relevant lines in audit.log.

Meanwhile I found some info on how to enable logging. However, I failed to set it up correctly (log_outputs="1:file:/var/log/libvirt/libvirtd.log" in libvirtd.conf, service has been restarted afterwards), as there is nothing written to it after libvirtd is started (e.g. when I invoke virsh start testrunner).

This message is a reminder that Fedora 20 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 20. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '20'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 20 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

This was fixed by:

commit db35beaa1d276cc229dcbbc8460ce2fccdda5084
Author: Cole Robinson <crobinso>
Date:   Thu Sep 10 12:35:00 2015 -0400

    qemu: command: Report stderr from qemu-bridge-helper