mknod: xxx: Operation not permitted

[Ralf Corsepius]

On Thu, 2004-12-16 at 03:43 -0500, Richard Hally wrote:
> Ralf Corsepius wrote:

> >Trying to create a char-device as ordinary user, results into this:
> ># mknod /var/tmp/bla-1.0.0/etc/udev/devices/bla01 c 212 0
> >mknod: `/var/tmp/bla-1.0.0/etc/udev/devices/bla01': Operation not permitted
> >
> >Any explanation for this behavior?
> >
> >Is it mknod trying to be overly clever or is it an selinux bug (This is
> >on a FC3 system with selinux-policy-targeted)?
> >
> >This issue prevents one from being able to build rpms containing special
> >devices as ordinary users.

> The first thing to look for if you suspect SELinux is acv denied 
> messages in /var/log/messages.
None such message.

>  Another thing to try is to "setenforce 0" 
Tried, it didn't change anything. I also tried on a system booted with
selinux=0.

> and try the command again to see if you get different results.
I fear the culprit is the mknod syscall, i.e. glibc.

stracing show mknod(2) returning EPERM and man 2 mknod says:
       EPERM  mode  requested  creation  of  something  other than a regular file, FIFO
              (named pipe), or Unix domain socket, and the caller is not the superuser;

=> Building rpms as ordinary user can not work for packages wanting to
provide special files (Typically kernel drivers).

I am stumped - This is pretty severe security issue as far as rpms are
concerned.

Ralf