Recent issue with pkg base missing setuid

[Ed Maste]

On 4 December 2017 at 16:56, Baptiste Daroussin <bapt at freebsd.org> wrote:
>
> So this is the issue, somewhere in the way libarchive is handling the hardlinks.

I'm not sure libarchive is at fault, it seems to be a bug/limitation
in the way install handles links with -M. For regular installs we
invoke:
    install -l h <prog> <link>
and the link then has the same permissions via the existing inode.

With -M install produces a metalog containing
./<link> type=file mode=0755 size=0
(i.e., permissions not explicitly set) and we end up with two entries
in the metalog referencing two names for the same inode, but with
different permissions.

If we passed in the mode when invoking install for a hardlink we
should have the expected permissions, regardless of sorting:
# install -M METALOG -m4554 -l h <prog> <link>
./<link> type=file mode=04554 size=0

On a positive note there are only a few Makefiles with LINKS as well
as BINOWN, BINMODE, or BINGRP. As far as I can tell:

release/picobsd/tinyware/passwd/Makefile
sbin/shutdown/Makefile
usr.bin/at/Makefile
usr.sbin/authpf/Makefile

and of these shutdown is the only one that has a link that's not
already in alpha order.