Index: pym/portage.py
===================================================================
--- pym/portage.py	(revision 5128)
+++ pym/portage.py	(revision 5134)
@@ -6093,7 +6093,8 @@
 			mysettings.get("CONFIG_PROTECT","").split(),
 			mysettings.get("CONFIG_PROTECT_MASK","").split())
 		self.updateprotect = protect_obj.updateprotect
-		self.isprotected = protect_obj.isprotected
+		self._config_protect = protect_obj
+		self._installed_instance = None
 		self.contentscache=[]
 		self._contents_inodes = None
 
@@ -6293,8 +6294,6 @@
 			mykeys.sort()
 			mykeys.reverse()
 
-			self.updateprotect()
-
 			#process symlinks second-to-last, directories last.
 			mydirs=[]
 			modprotect="/lib/modules/"
@@ -6325,7 +6324,7 @@
 				# upgraded. We effectively only want one half of the config protection
 				# functionality for /lib/modules. For portage-ng both capabilities
 				# should be able to be independently specified.
-				if self.isprotected(obj) or ((len(obj) > len(modprotect)) and (obj[0:len(modprotect)]==modprotect)):
+				if obj.startswith(modprotect):
 					writemsg_stdout("--- cfgpro %s %s\n" % (pkgfiles[objkey][0], obj))
 					continue
 
@@ -6427,6 +6426,31 @@
 
 		return False
 
+	def isprotected(self, filename):
+		"""In cases where an installed package in the same slot owns a
+		protected file that will be merged, bump the mtime on the installed
+		file in order to ensure that it isn't unmerged."""
+		if not self._config_protect.isprotected(filename):
+			return False
+		if self._installed_instance is None:
+			return True
+		mydata = self._installed_instance.getcontents().get(filename, None)
+		if mydata is None:
+			return True
+
+		# Bump the mtime in order to ensure that the old config file doesn't
+		# get unmerged.  The user will have an opportunity to merge the new
+		# config with the old one.
+		try:
+			os.utime(filename, None)
+		except OSError, e:
+			if e.errno != errno.ENOENT:
+				raise
+			del e
+			# The file has disappeared, so it's not protected.
+			return False
+		return True
+
 	def treewalk(self, srcroot, destroot, inforoot, myebuild, cleanup=0,
 		mydbapi=None, prev_mtimes=None):
 		# srcroot  = ${D};
@@ -6447,6 +6471,14 @@
 		for v in self.vartree.dbapi.cp_list(self.mysplit[0]):
 			otherversions.append(v.split("/")[1])
 
+		slot_matches = self.vartree.dbapi.match(
+			"%s:%s" % (self.mysplit[0], self.settings["SLOT"]))
+		if slot_matches:
+			# Used by self.isprotected().
+			self._installed_instance = dblink(self.cat,
+				catsplit(slot_matches[0])[1], destroot, self.settings,
+				vartree=self.vartree)
+
 		# check for package collisions
 		if "collision-protect" in self.settings.features:
 			collision_ignore = set([normalize_path(myignore) for myignore in \