The normal 'install'/'cp' do not preserve XATTRS, and therefore we get from: ~ $ paxctl-ng -v /var/tmp/paludis/dev-lang-python-2.7.10-r1/work/x86_64-pc-linux-gnu/python /var/tmp/paludis/dev-lang-python-2.7.10-r1/work/x86_64-pc-linux-gnu/python: PT_PAX : -e--- XATTR_PAX : -E--- to ~ $ paxctl-ng -v /var/tmp/paludis/dev-lang-python-2.7.10-r1/image/usr/bin/python2.7 /var/tmp/paludis/dev-lang-python-2.7.10-r1/image/usr/bin/python2.7: PT_PAX : -e--- XATTR_PAX : not found breaking a lot of stuff on hardened kernels. Portage therefore uses 'install-xattr' instead. In fact, specifying PATH="/usr/lib64/portage/python2.7/ebuild-helpers/xattr/:${PATH}" in /etc/paludis/bashrc gets me: ~ $ paxctl-ng -v /var/tmp/paludis/dev-lang-python-2.7.10-r1/image/usr/bin/python2.7 /var/tmp/paludis/dev-lang-python-2.7.10-r1/image/usr/bin/python2.7: PT_PAX : -e--- XATTR_PAX : -E--- The next thing stripping away XATTRS is 'strip', where again portage backups and restores XATTRS. Using paludis I simply set 'build_options symbols=preserve' to avoid stripping.
Instead, the simplest solution would be to depend on 'sys-apps/install-xattr' and symlink /usr/bin/install-xattr to /usr/libexec/paludis/utils/
Paludis has been removed from the tee.
