Comment # 3 on bug 1051065 from James Carter

@ludwig: You're right that udev creates devices with a well-defined owner
and mode, but there are two flies in that ointment:  

What set off my problem was, the mode of /dev/random got messed up during
(ab)normal operation, not at the time of creation, and udev is not going
to pay attention to such an event.  

Also, the file that was giving me grief was /var/lib/named/dev/random, which
is not created by udev; the pre-existing /dev/random is copied into the
chroot jail by rsync (or may be created by mknod in older package versions). 

So we need to do all three: make sure that the rules in /etc/udev/rules.d are
creating with the wanted mode and owner, but also, in the (probably rare)
special cases where SuSE scripts copy and/or create device inodes, to 
include them in /etc/permissions and friends, and also, allow the sysadmin
to add special non-SuSE devices to /etc/permissions.local and have the
resulting fixes actually happen.