Create a Named Pipe Safely with GNU mknod

Two processes need to talk without a network socket, and a FIFO is the boring, reliable answer. This guide creates one with mknod, confirms the kernel sees it as a named pipe, and removes it cleanly afterwards. It is a short task: allow about five minutes if you already know where the pipe belongs. The examples use GNU coreutils 9.4, installed here as package coreutils 9.4-3ubuntu6.3.

Before you start

mknod creates a filesystem entry with a specified type. The type p creates a FIFO, also called a named pipe, giving unrelated processes a path through which they can exchange a stream of bytes. The command does not start a reader or writer itself, and opening a FIFO can wait until the other side opens it too.

Use an ordinary user-owned directory for this exercise.
Creating a block or character device usually needs elevated privileges and can expose real kernel devices.
Do not practise by guessing major and minor numbers, and do not replace an existing path.

1. Check which mknod you are running

A shell can provide its own command with the same name. This guide describes GNU mknod, so call /usr/bin/mknod when you need that exact implementation.

/usr/bin/mknod --version

On this machine the first line is:

mknod (GNU coreutils) 9.4

If your output names a different implementation, read its help and manpage before copying the options in this guide.

2. Create a disposable workspace

Make a directory that only you can access, then keep its path in a shell variable. The variable is a placeholder for the rest of the commands, not a system location.

pipe_dir=$(mktemp -d)
echo "$pipe_dir"

Expect a path similar to /tmp/tmp.A7k9Lm2Q. If the command fails, fix the temporary-directory problem rather than creating the pipe elsewhere.

3. Create the FIFO

Pass the new pathname followed by p. For a FIFO, do not add major and minor numbers: those are required for block, character, and the GNU-compatible u types, but must be omitted for p.

/usr/bin/mknod "$pipe_dir/events" p

A successful command prints nothing. Verify the result with stat:

stat -c 'type=%F mode=%a path=%n' "$pipe_dir/events"

You should see type=fifo. The mode is affected by your umask; on the guide machine, the default produced mode=644, but yours may differ. A FIFO is not a regular file, so writing to it normally requires a reader at the same time.

4. Set a deliberate permission mode

For a pipe carrying private data, choose permissions rather than relying on the umask. The -m option sets the permission bits directly instead of starting from a=rw and applying the umask.

/usr/bin/mknod -m 600 "$pipe_dir/private-events"
stat -c 'type=%F mode=%a path=%n' "$pipe_dir/private-events"

Expected output is:

type=fifo mode=600 path=/tmp/tmp.A7k9Lm2Q/private-events

The final path component will be different on your system. Mode 600 gives the owner read and write permission and gives group or other users no access at all. Choose a group-accessible mode only when the directory and the data flow are also appropriate for that group.

5. Use the FIFO without hanging your shell

Opening a FIFO for writing can block until a reader opens it. Start a reader in the background, then write one line: this demonstrates the pipe without leaving a process waiting for a peer.

cat "$pipe_dir/events" &
reader_pid=$!
printf '%s\n' 'one test event' > "$pipe_dir/events"
wait "$reader_pid"

The reader prints:

one test event

The background job is part of this example's control flow. If you interrupt the writer, check for and stop the reader before continuing:

jobs -l
kill "$reader_pid" 2>/dev/null || true

kill here is ordinary user-level cleanup for a process you started. Do not send signals to an unfamiliar process merely because a FIFO operation is waiting.

6. Remove the test entries

Removing a FIFO does not terminate a process that already has it open, but it does remove the pathname. Confirm the two names before deleting them, then remove only those entries and the empty temporary directory.

printf '%s\n' "$pipe_dir/events" "$pipe_dir/private-events"
rm -- "$pipe_dir/events" "$pipe_dir/private-events"
rmdir -- "$pipe_dir"

There is normally no output. If rmdir says the directory is not empty, list it and remove only files you recognise. Never broaden the command to a system directory or use a recursive delete for this exercise.

Device nodes and number formats

The other types carry a different safety boundary. b creates a buffered block special file. c and u create an unbuffered character special file. Both require MAJOR and MINOR: get the pair wrong and you can point at a real device or fail with a permission or device error. Creating one normally needs root or a narrowly delegated capability. Only use numbers supplied by the device's documentation or by an intentional system configuration.

GNU mknod reads a number beginning with 0x or 0X as hexadecimal. A number beginning with 0 is octal; anything else is decimal. This is easy to misread in a maintenance command, so write the base explicitly in your procedure and verify the resulting node before a service uses it.

SELinux or SMACK systems also provide -Z and --context for setting a security context. Use those only when they match the policy for the target path. A context change is security-sensitive and is not needed for the FIFO demonstration above.

Common failure modes

"File exists": stop and inspect the existing path with stat. Do not overwrite it or remove it until you know which service owns it.
"Permission denied": check directory write and search permissions. Do not jump straight to sudo; choose a directory you own for a test.
The command waits: a FIFO is synchronising its endpoints. Open a reader and writer deliberately, or interrupt the test and inspect background jobs.
The wrong command runs: compare command -V mknod with /usr/bin/mknod --version. Shell-specific implementations may accept different options.

Done means

/usr/bin/mknod --version identified the implementation you intended to use.
stat reported type=fifo for the created entry.
You chose permissions deliberately and understood the umask effect.
The reader and writer exited, and the temporary FIFO entries were removed.