Comment 4 for bug 1892895

Also encountered it during thin LV creation via lvcreate:

https://pastebin.canonical.com/p/3TDh83RgXy/

lvcreate -T -V 4g -n testvol cinder-volumes/cinder-volumes-pool
  device-mapper: reload ioctl on (253:3) failed: Operation not permitted
  Aborting. Failed to locally activate thin pool cinder-volumes/cinder-volumes-pool.

Using bpftrace (with BTF support via libbpf and 5.11 kernel) I was also able to confirm that EPERM (-1) definitely comes from devcgroup_check_permission:
https://paste.ubuntu.com/p/Hpfkd2FJ5t/
# ...
cgroup permission check (devcgroup_check_permission) for: major: 253, minor: 2
kstack:

        bpf_prog_3d4bb0e1b7559353_devcgroup_check+186
        bpf_prog_3d4bb0e1b7559353_devcgroup_check+186
        bpf_trampoline_6442502014_0+85
        devcgroup_check_permission+5
        dm_get_table_device+254
        dm_get_device+437
        linear_ctr+200
        dm_table_add_target+383
        table_load+291
        ctl_ioctl+399
        dm_ctl_ioctl+14
        __x64_sys_ioctl+145
        do_syscall_64+56
        entry_SYSCALL_64_after_hwframe+68

ustack:

        ioctl+11
        dm_task_run+828
        _reload_with_suppression_v4+783
        dm_task_run+349
        _load_node+697
        dm_tree_preload_children+450
        _tree_action+1284
        dev_manager_activate+49
        _lv_activate_lv+159
        _lv_activate+1271
        lv_activate_with_filter+147
        activate_lv+244
        _lv_create_an_lv+2473
        lv_create_single+1131
        _lvcreate_single+1590
        _process_vgnameid_list+1688
        process_each_vg+1274
        lvcreate+543
        lvm_run_command+2912
        lvm2_main+1426
        main+36
        __libc_start_main+243

retval -1