between when something is installed and when post-install runs. Short
  of a global lock (which we probably need anyway someday), my solution
  is this. In your makefiles, add these variables before the line that
  has the include of $(TESTBED_SRCDIR)/GNUmakerules:

  	SETUID_BIN_SCRIPTS   =
  	SETUID_SBIN_SCRIPTS  =

  I have added three new rules to GNUmakerules that look like this:

  	$(addprefix $(SBINDIR)/, $(SETUID_SBIN_SCRIPTS)): $(SBINDIR)/%: %
  		echo "Installing (setuid) $<"
  		-mkdir -p $(INSTALL_SBINDIR)
  		$(SUDO) $(INSTALL) -o root -m 4755 $< $@

  Yep, your eyes ain't lying to you; use sudo to run the target so that
  install does the right thing (which is that the old file is not
  replaced until the new one has the proper attributes on it).

  Note that post-install is still needed for the initial install, but
  should no longer be needed for day to day installs since all that other
  stuff post-install does is mkdir/chmod on directories.