It may make sense for us to have a package of paxrat with common configurations for Debian users:
https://github.com/subgraph/paxrat This would ensure that everyone can use this kernel and have xorg work as expected, for example. Otherwise, I think we will see a lot of people who just run: paxctl -m /usr/bin/Xorg paxctl one off runs isn't great for a full solution. paxrat improves on this as package updates and other things can stomp on pax related xattributes. paxrat seems very very useful in this context - we get configuration files as well as dpkg hooks.