Exclude /var/empty from tar extract and make sure its permissions are respected when it's created

src/etc/inc/system.inc

@@ -1891,7 +1891,7 @@ function system_ntp_configure() {
 
 	/* if /var/empty does not exist, create it */
 	if (!is_dir("/var/empty")) {
-		mkdir("/var/empty", 0775, true);
+		mkdir("/var/empty", 0555, true);
 	}
 
 	/* start opentpd, set time now and use /var/etc/ntpd.conf */

src/etc/pfSense-rc

@@ -198,6 +198,7 @@ SWAPDEVICE=`/bin/cat /etc/fstab | /usr/bin/grep swap | /usr/bin/cut -f1`
 
 # make some directories in /var
 /bin/mkdir -p $varrunpath /var/log /var/etc /var/db/entropy /var/db/rrd /var/at/jobs/ /var/empty /var/log/nginx 2>/dev/null
+chmod 0555 /var/empty
 /bin/rm -rf $varrunpath/*
 
 # Cleanup configuration files from previous instance

tools/templates/core_pkg/base/metadir/+INSTALL

@@ -27,7 +27,8 @@ chflags -R noschg \
 echo "===> Extracting new base tarball"
 
 # Install new base files
-tar -C / -xJPUf /usr/local/share/%%PRODUCT_NAME%%/base.txz
+tar -C / --exclude ./var/empty -xJPUf \
+	/usr/local/share/%%PRODUCT_NAME%%/base.txz
 
 echo "===> Removing static obsoleted files"