[gentoo-hardened] persistent paxctl -m?

[Grant]

I seem to need to remember to paxctl -m the firefox binary whenever I
upgrade firefox.  This inevitably leads to a browser crash and lost
time/info.  Can I set up paxctl -m to persist, even if firefox is
upgraded?

- Grant