--- a/ChangeLog	Fri Jul 29 07:40:56 2016 +0100
+++ b/ChangeLog	Mon Sep 19 17:04:34 2016 +0100
@@ -1,3 +1,22 @@
+2016-04-07  Andrew John Hughes  <gnu_andrew@member.fsf.org>
+
+	PR3131: PaX marking fails on filesystems which
+	don't support extended attributes
+	* Makefile.am:
+	(icedtea): Pass true to pax-mark-vm to fail
+	if PaX marking fails.
+	(icedtea-debug): Likewise.
+	(icedtea-boot): Likewise.
+	(install-exec-local): Pass false to pax-mark-vm
+	so that only a warning is produced if PaX marking
+	fails on the installed version.
+	* NEWS: Updated.
+	* pax-mark-vm.in:
+	Add a second option, FAIL_ON_ERROR, which will
+	cause the script to exit if it can't PaX mark
+	when set to true, but just issue a warning when
+	set to false.
+
 2016-07-28  Andrew John Hughes  <gnu.andrew@member.fsf.org>
 
 	* NEWS: Add 2.6.7 release notes.

--- a/Makefile.am	Fri Jul 29 07:40:56 2016 +0100
+++ b/Makefile.am	Mon Sep 19 17:04:34 2016 +0100
@@ -2032,7 +2032,7 @@
 	  $(ICEDTEA_ENV) \
 	  -C openjdk/ \
 	  $(ICEDTEA_BUILD_TARGET)
-	$(abs_top_builddir)/pax-mark-vm $(BUILD_SDK_DIR)
+	$(abs_top_builddir)/pax-mark-vm $(BUILD_SDK_DIR) true
 	mkdir -p $(BUILD_SDK_DIR)/jre/lib/$(INSTALL_ARCH_DIR)
 	mkdir -p $(BUILD_JRE_DIR)/lib/$(INSTALL_ARCH_DIR)
 	mkdir -p $(BUILD_SDK_DIR)/jre/lib/ext
@@ -2184,7 +2184,7 @@
 	  $(ICEDTEA_ENV) \
 	  -C openjdk/ \
 	  $(ICEDTEA_DEBUG_BUILD_TARGET)
-	$(abs_top_builddir)/pax-mark-vm $(BUILD_DEBUG_SDK_DIR)
+	$(abs_top_builddir)/pax-mark-vm $(BUILD_DEBUG_SDK_DIR) true
 	mkdir -p $(BUILD_DEBUG_SDK_DIR)/jre/lib/$(INSTALL_ARCH_DIR)
 	mkdir -p $(BUILD_DEBUG_JRE_DIR)/lib/$(INSTALL_ARCH_DIR)
 	mkdir -p $(BUILD_DEBUG_SDK_DIR)/jre/lib/ext
@@ -2358,7 +2358,7 @@
 	  $(ICEDTEA_ENV_BOOT) \
 	  -C openjdk-boot \
 	  $(ICEDTEA_BUILD_TARGET)
-	$(abs_top_builddir)/pax-mark-vm $(BUILD_BOOT_SDK_DIR)
+	$(abs_top_builddir)/pax-mark-vm $(BUILD_BOOT_SDK_DIR) true
 # Fix permissions on JARs updated during build if PR1437 bug is present
 if PR1437_PRESENT
 	if [ -e $(BUILD_BOOT_SDK_DIR)/lib/sa-jdi.jar ] ; then \
@@ -3256,7 +3256,7 @@
 	for files in $(BUILD_SDK_DIR)/tapset/*.stp; do \
 	  $(call install_file,$${files},$(DESTDIR)${prefix}/tapset,$(INSTALL_DATA));\
 	done
-	$(abs_top_builddir)/pax-mark-vm $(DESTDIR)${prefix}
+	$(abs_top_builddir)/pax-mark-vm $(DESTDIR)${prefix} false
 
 install-data-local:
 	${mkinstalldirs} $(DESTDIR)${prefix}

--- a/NEWS	Fri Jul 29 07:40:56 2016 +0100
+++ b/NEWS	Mon Sep 19 17:04:34 2016 +0100
@@ -16,6 +16,8 @@
 
 * Backports
   - S8076221, PR2809, RH1302385: Disable RC4 cipher suites
+* Bug fixes
+  - PR3131: PaX marking fails on filesystems which don't support extended attributes
 
 New in release 2.6.7 (2016-07-28):
 

--- a/pax-mark-vm.in	Fri Jul 29 07:40:56 2016 +0100
+++ b/pax-mark-vm.in	Mon Sep 19 17:04:34 2016 +0100
@@ -1,13 +1,25 @@
 #!/bin/sh
 
+JDK=${1}
+FAIL_ON_ERROR=${2}
+
 # Taken from Gentoo's pax-utils.eclass
 list_paxables() {
 	file "$@" 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//'
 }
 
 if test "x@PAX_COMMAND@" != "x"; then
-	for paxable in `list_paxables "${1}"/bin/* "${1}"/jre/bin/*`; do
+    if @PAX_COMMAND@ -m "${JDK}"/bin/java; then
+	for paxable in `list_paxables "${JDK}"/bin/* "${JDK}"/jre/bin/*`; do
 		echo "PaX mark @PAX_COMMAND_ARGS@ ${paxable}"
 		@PAX_COMMAND@ @PAX_COMMAND_ARGS@ "${paxable}"
 	done
+    else
+	if test "x${FAIL_ON_ERROR}" = "xtrue"; then
+	    echo "ERROR: Could not apply PaX markings to files in ${JDK}";
+	    exit -1;
+	else
+	    echo "WARNING: Could not apply PaX markings to files in ${JDK}";
+	fi
+    fi
 fi