and avoid setgid kmem on NetBSD with privileged installation. XXX: if certain owner/group/mode for executable are really required on sertain XXX: platforms, set SPECIAL_PERMS individually.
