Re: [gentoo-hardened] persistent paxctl -m?

[Grant]

>>> and create executable shell script in that dir: mozilla-firefox-bin.postinst
>>> ---cut---
>>> #!/bin/bash
>>> ewarn "Running chpax -m /opt/firefox/firefox-bin to avoid crash on flash!"
>>> chpax -m /opt/firefox/firefox-bin
>>> ---cut---
>>>
>>
>> Of course, if you compile firefox instead of using firefox-bin, then file
>> should be named mozilla-firefox.postinst and you should use there paxctl
>> instead of chpax.
>>
> A simple cron job or slightly-less-simple RBAC policy can do the trick.
> There's no need to mess with portage, imho.

Thanks for the suggestions everyone.  I think this type of persistence
should be built into portage.  Maybe /etc/portage/package.nomprotect.
Do you agree?  Should I file a bug?

- Grant