Rebuild the srpm as a non-root user and you get an rpm which installs cpio owned by the user who built the rpm.
Fixed (by adding missing %defattr) in cpio-2.4.2-16. Thanks for noticing.