From c01bdca9ba2ddfed14285ff36e1f6508c4452717 Mon Sep 17 00:00:00 2001
From: Renato Botelho <renato@netgate.com>
Date: Mon, 26 Dec 2016 16:53:51 -0200
Subject: [PATCH] Exclude /var/empty from tar extract and make sure its
 permissions are respected when it's created

---
 src/etc/inc/system.inc                         | 2 +-
 src/etc/pfSense-rc                             | 1 +
 tools/templates/core_pkg/base/metadir/+INSTALL | 3 ++-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/etc/inc/system.inc b/src/etc/inc/system.inc
index b043361057..5df1562ad5 100644
--- a/src/etc/inc/system.inc
+++ b/src/etc/inc/system.inc
@@ -1891,7 +1891,7 @@ function system_ntp_configure() {
 
 	/* if /var/empty does not exist, create it */
 	if (!is_dir("/var/empty")) {
-		mkdir("/var/empty", 0775, true);
+		mkdir("/var/empty", 0555, true);
 	}
 
 	/* start opentpd, set time now and use /var/etc/ntpd.conf */
diff --git a/src/etc/pfSense-rc b/src/etc/pfSense-rc
index e46ed23e60..382da912fe 100755
--- a/src/etc/pfSense-rc
+++ b/src/etc/pfSense-rc
@@ -198,6 +198,7 @@ SWAPDEVICE=`/bin/cat /etc/fstab | /usr/bin/grep swap | /usr/bin/cut -f1`
 
 # make some directories in /var
 /bin/mkdir -p $varrunpath /var/log /var/etc /var/db/entropy /var/db/rrd /var/at/jobs/ /var/empty /var/log/nginx 2>/dev/null
+chmod 0555 /var/empty
 /bin/rm -rf $varrunpath/*
 
 # Cleanup configuration files from previous instance
diff --git a/tools/templates/core_pkg/base/metadir/+INSTALL b/tools/templates/core_pkg/base/metadir/+INSTALL
index 4f53a355c9..9dd50eef8b 100644
--- a/tools/templates/core_pkg/base/metadir/+INSTALL
+++ b/tools/templates/core_pkg/base/metadir/+INSTALL
@@ -27,7 +27,8 @@ chflags -R noschg \
 echo "===> Extracting new base tarball"
 
 # Install new base files
-tar -C / -xJPUf /usr/local/share/%%PRODUCT_NAME%%/base.txz
+tar -C / --exclude ./var/empty -xJPUf \
+	/usr/local/share/%%PRODUCT_NAME%%/base.txz
 
 echo "===> Removing static obsoleted files"