7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

*** 181,190 ****
--- 181,192 ----
  
  <TSTATE>attr    { return ATTR; }
  
  <TSTATE>admin   { return ADMIN; }
  
+ <TSTATE>security-flags { return SECFLAGS; }
+ 
  <TSTATE>zonename        { return ZONENAME; }
  <CSTATE>zonename        { return ZONENAME; }
  
  <TSTATE>dataset { return DATASET; }
  
*** 306,315 ****
--- 308,326 ----
  <CSTATE>auths   { return AUTHS; }
  
  <TSTATE>fs-allowed      { return FS_ALLOWED; }
  <CSTATE>fs-allowed      { return FS_ALLOWED; }
  
+ <TSTATE>default { return DEFAULT; }
+ <CSTATE>default { return DEFAULT; }
+ 
+ <TSTATE>lower { return LOWER; }
+ <CSTATE>lower { return LOWER; }
+ 
+ <TSTATE>upper { return UPPER; }
+ <CSTATE>upper { return UPPER; }
+ 
  <TSTATE>=       { return EQUAL; }
  <LSTATE>=       { return EQUAL; }
  <CSTATE>=       { return EQUAL; }
  
  <TSTATE>"["     {