--- old/usr/src/cmd/svc/milestone/process-security.xml	2016-09-21 15:14:29.801608959 -0400
+++ new/usr/src/cmd/svc/milestone/process-security.xml	2016-09-21 15:14:29.959822598 -0400
@@ -41,27 +41,27 @@
 		</property_group>
 
 		<property_group name='default' type='application'>
-		  <propval name='aslr' type='boolean' value='false' />
-		  <propval name='forbidnullmap' type='boolean' value='false' />
-		  <propval name='noexecstack' type='boolean' value='false' />
+		  <property name='aslr' type='boolean' />
+		  <property name='forbidnullmap' type='boolean' />
+		  <property name='noexecstack' type='boolean' />
 
 		  <propval name='value_authorization' type='astring'
 			   value='solaris.smf.value.process-security' />
 		</property_group>
 
                 <property_group name='lower' type='application'>
-		  <propval name='aslr' type='boolean' value='false' />
-		  <propval name='forbidnullmap' type='boolean' value='false' />
-		  <propval name='noexecstack' type='boolean' value='false' />
+		  <property name='aslr' type='boolean' />
+		  <property name='forbidnullmap' type='boolean' />
+		  <property name='noexecstack' type='boolean' />
 
 		  <propval name='value_authorization' type='astring'
 			   value='solaris.smf.value.process-security' />
 		</property_group>
 
                 <property_group name='upper' type='application'>
-		  <propval name='aslr' type='boolean' value='true' />
-		  <propval name='forbidnullmap' type='boolean' value='true' />
-		  <propval name='noexecstack' type='boolean' value='true' />
+		  <property name='aslr' type='boolean' />
+		  <property name='forbidnullmap' type='boolean' />
+		  <property name='noexecstack' type='boolean' />
 
 		  <propval name='value_authorization' type='astring'
 			   value='solaris.smf.value.process-security' />
--- old/usr/src/lib/librestart/common/librestart.c	2016-09-21 15:14:31.553749390 -0400
+++ new/usr/src/lib/librestart/common/librestart.c	2016-09-21 15:14:31.589969033 -0400
@@ -3171,15 +3171,8 @@
 		goto out;
 	}
 
-	if (strcmp(cip->vbuf, ":default") == 0) {
-		if (secflags_parse(&cip->def_secflags.psf_inherit, "default",
-		    &cip->secflag_delta) != 0) {
-			err = mc_error_create(err, EINVAL, "couldn't parse "
-			    "security flags: %s", cip->vbuf);
-			goto out;
-		}
-	} else {
-		if (secflags_parse(&cip->def_secflags.psf_inherit, cip->vbuf,
+	if (strcmp(cip->vbuf, ":default") != 0) {
+		if (secflags_parse(NULL, cip->vbuf,
 		    &cip->secflag_delta) != 0) {
 			err = mc_error_create(err, EINVAL, "couldn't parse "
 			    "security flags: %s", cip->vbuf);
@@ -3433,13 +3426,6 @@
 			    "default security-flags");
 			goto out;
 		}
-
-		if (secflags_parse(&cip->def_secflags.psf_inherit, "default",
-		    &cip->secflag_delta) != 0) {
-			err = mc_error_create(err, EINVAL, "couldn't parse "
-			    "security flags: %s", cip->vbuf);
-			goto out;
-		}
 	}
 
 	*mcpp = cip;
@@ -3512,7 +3498,6 @@
 {
 	pid_t mypid = -1;
 	int r, ret;
-	secflagdelta_t delta = {0};
 
 	cip->pwbuf = NULL;
 	*fp = NULL;
@@ -3609,34 +3594,30 @@
 	}
 
 
-	delta.psd_ass_active = B_TRUE;
-	secflags_copy(&delta.psd_assign, &cip->def_secflags.psf_inherit);
 	if (psecflags(P_PID, P_MYID, PSF_INHERIT,
-	    &delta) != 0) {
-		*fp = "psecflags (inherit defaults)";
+	    &cip->def_secflags.ss_default) != 0) {
+		*fp = "psecflags (default inherit)";
 		ret = errno;
 		goto out;
 	}
 
-	if (psecflags(P_PID, P_MYID, PSF_INHERIT,
-	    &cip->secflag_delta) != 0) {
-		*fp = "psecflags (inherit)";
+	if (psecflags(P_PID, P_MYID, PSF_LOWER,
+	    &cip->def_secflags.ss_lower) != 0) {
+		*fp = "psecflags (default lower)";
 		ret = errno;
 		goto out;
 	}
 
-	secflags_copy(&delta.psd_assign, &cip->def_secflags.psf_lower);
-	if (psecflags(P_PID, P_MYID, PSF_LOWER,
-	    &delta) != 0) {
-		*fp = "psecflags (lower)";
+	if (psecflags(P_PID, P_MYID, PSF_UPPER,
+	    &cip->def_secflags.ss_upper) != 0) {
+		*fp = "psecflags (default upper)";
 		ret = errno;
 		goto out;
 	}
 
-	secflags_copy(&delta.psd_assign, &cip->def_secflags.psf_upper);
-	if (psecflags(P_PID, P_MYID, PSF_UPPER,
-	    &delta) != 0) {
-		*fp = "psecflags (upper)";
+	if (psecflags(P_PID, P_MYID, PSF_INHERIT,
+	    &cip->secflag_delta) != 0) {
+		*fp = "psecflags (from manifest)";
 		ret = errno;
 		goto out;
 	}
--- old/usr/src/lib/librestart/common/librestart.h	2016-09-21 15:14:33.182447976 -0400
+++ new/usr/src/lib/librestart/common/librestart.h	2016-09-21 15:14:33.218357770 -0400
@@ -274,7 +274,7 @@
 	gid_t		gid, egid;
 	int		ngroups;		/* -1 means use initgroups(). */
 	gid_t		groups[NGROUPS_MAX];
-	psecflags_t	def_secflags;
+	scf_secflags_t	def_secflags;
 	secflagdelta_t	secflag_delta;
 	priv_set_t	*lpriv_set, *priv_set;
 	char		*corefile_pattern;	/* Optional. */
--- old/usr/src/lib/libscf/common/highlevel.c	2016-09-21 15:14:34.188705267 -0400
+++ new/usr/src/lib/libscf/common/highlevel.c	2016-09-21 15:14:34.224099420 -0400
@@ -33,6 +33,7 @@
 #include <assert.h>
 #include <libuutil.h>
 #include <string.h>
+#include <strings.h>
 #include <stdlib.h>
 #include <sys/systeminfo.h>
 #include <sys/uadmin.h>
@@ -363,12 +364,12 @@
  * of the mapfile, even though we don't ever use it, and it will never work.
  */
 struct group_desc {
-	secflagset_t *set;
+	secflagdelta_t *delta;
 	char *fmri;
 };
 
 int
-scf_default_secflags(scf_handle_t *hndl, psecflags_t *flags)
+scf_default_secflags(scf_handle_t *hndl, scf_secflags_t *flags)
 {
 #if !defined(NATIVE_BUILD)
 	scf_property_t *prop;
@@ -386,14 +387,13 @@
 		{NULL, NULL}
 	};
 
-	groups[0].set = &flags->psf_inherit;
-	groups[1].set = &flags->psf_lower;
-	groups[2].set = &flags->psf_upper;
+	bzero(flags, sizeof (*flags));
 
-	/* Ensure sane defaults */
-	psecflags_default(flags);
+	groups[0].delta = &flags->ss_default;
+	groups[1].delta = &flags->ss_lower;
+	groups[2].delta = &flags->ss_upper;
 
-	for (g = groups; g->set != NULL; g++) {
+	for (g = groups; g->delta != NULL; g++) {
 		for (flag = 0; (flagname = secflag_to_str(flag)) != NULL;
 		    flag++) {
 			char *pfmri;
@@ -421,9 +421,9 @@
 			(void) scf_value_get_boolean(val, &flagval);
 
 			if (flagval != 0)
-				secflag_set(g->set, flag);
+				secflag_set(&g->delta->psd_add, flag);
 			else
-				secflag_clear(g->set, flag);
+				secflag_set(&g->delta->psd_rem, flag);
 
 next:
 			uu_free(pfmri);
@@ -432,9 +432,6 @@
 		}
 	}
 
-	if (!psecflags_validate(flags))
-		return (-1);
-
 	return (0);
 #else
 	assert(0);
--- old/usr/src/lib/libscf/inc/libscf.h	2016-09-21 15:14:35.318528311 -0400
+++ new/usr/src/lib/libscf/inc/libscf.h	2016-09-21 15:14:35.354398184 -0400
@@ -28,9 +28,13 @@
 
 
 #include <stddef.h>
-#include <sys/types.h>
 #include <libnvpair.h>
 
+#ifndef NATIVE_BUILD
+#include <sys/secflags.h>
+#endif	/* NATIVE_BUILD */
+#include <sys/types.h>
+
 #ifdef	__cplusplus
 extern "C" {
 #endif
@@ -197,6 +201,26 @@
 typedef struct scf_tmpl_error scf_tmpl_error_t;
 
 /*
+ * This unfortunately needs to be public, because consumers of librestart must
+ * deal with it
+ */
+typedef struct {
+#ifndef NATIVE_BUILD
+	secflagdelta_t ss_default;
+	secflagdelta_t ss_lower;
+	secflagdelta_t ss_upper;
+#else
+	/*
+	 * This is never used, but is necessary for bootstrapping.
+	 * Not even the size matters.
+	 */
+	void *ss_default;
+	void *ss_lower;
+	void *ss_upper;
+#endif /* NATIVE_BUILD */
+} scf_secflags_t;
+
+/*
  * scf_tmpl_strerror() human readable flag
  */
 #define	SCF_TMPL_STRERROR_HUMAN	0x1
--- old/usr/src/lib/libscf/inc/libscf_priv.h	2016-09-21 15:14:36.419446523 -0400
+++ new/usr/src/lib/libscf/inc/libscf_priv.h	2016-09-21 15:14:36.454833948 -0400
@@ -596,7 +596,7 @@
 int _scf_notify_get_params(scf_propertygroup_t *, nvlist_t *);
 
 #if !defined(NATIVE_BUILD)
-int scf_default_secflags(scf_handle_t *, psecflags_t *);
+int scf_default_secflags(scf_handle_t *, scf_secflags_t *);
 #endif
 
 #define	SCF_NOTIFY_PARAMS_SOURCE_NAME	((const char *)"preference_source")
--- old/usr/src/man/man5/security-flags.5	2016-09-21 15:14:37.457886294 -0400
+++ new/usr/src/man/man5/security-flags.5	2016-09-21 15:14:37.493485023 -0400
@@ -78,8 +78,9 @@
 System default security-flags are configured via properties on the
 \fBsvc:/system/process-security\fR service, which contains a boolean property
 per-flag in the \fBdefault\fR, \fBlower\fR and \fBupper\fR, property groups.
-For example, to enable ASLR by default you would execute the following
-commands:
+The value indicates the setting of the flag, flags with no value take their
+defaults.  For example, to enable ASLR by default you would execute the
+following commands:
 .sp
 .in +2
 .nf
@@ -88,6 +89,15 @@
 .in -2
 .sp
 .P
+To restore the setting to the defaults you would execute:
+.sp
+.in +2
+.nf
+# svccfg -s svc:/system/process-security delpropvalue default/aslr true
+.fi
+.in -2
+.sp
+.P
 This can be done by any user with the \fBsolaris.smf.value.process-security\fR
 authorization.
 .P
--- old/usr/src/man/man5/smf_method.5	2016-09-21 15:14:39.108172697 -0400
+++ new/usr/src/man/man5/smf_method.5	2016-09-21 15:14:39.144191287 -0400
@@ -463,8 +463,9 @@
 .LP
 The "default" keyword specifies those flags specified in
 \fBsvc:/system/process-security\fR.  The "all" keyword enables all flags, the
-"none" keyword enables no flags.  Further flags may be added by specifying
-their name, or removed by specifying their name prefixed by '-' or '!'.
+"none" keyword enables no flags.  The "current" keyword specifies the current
+flags.  Flags may be added by specifying their name (optionally preceded
+by '+'), and removed by preceding their name with '-').
 .sp
 .LP
 Use of "all" has associated risks, as future versions of the system may
