Before firefox-20, paxctl -m was set only for the plugin-container, not for the firefox executable itself as long as firefox was built without jit. The firefox-20 ebuild also sets paxctl -m on firefox and firefox bin, even without jit. This is absolutely unacceptable from a security point of view. Any feature requiring paxctl in firefox needs to be configurable by a USE flag to turn it off and build a pax-compatible firefox.
If you would like to provide a patch that will allow us to disable pax-marking firefox and firefox-bin we are more then open to it. As it stands there is no possible configuration to get back to disabling pax-marking on the binary.
