Ebuild already does pax-mark -m, and this was enough on x86, but on amd64 pax-mark -r should be added - without it (on firefox binary) firefox hang on start and (on plugin-container) flash doesn't work.