7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

@@ -1416,10 +1416,26 @@
 
                 if (Pfdinfo_iter(P, iter_fd, &iter) != 0)
                         goto err;
         }
 
+
+        {
+                prsecflags_t *psf = NULL;
+
+                if (Psecflags(P, &psf) != 0)
+                        goto err;
+
+                if (write_note(fd, NT_SECFLAGS, psf,
+                    sizeof (prsecflags_t), &doff) != 0) {
+                        Psecflags_free(psf);
+                        goto err;
+                }
+
+                Psecflags_free(psf);
+        }
+
 #if defined(__i386) || defined(__amd64)
         /* CSTYLED */
         {
                 struct ssd *ldtp;
                 size_t size;

@@ -1499,10 +1515,11 @@
         /*
          * Wipe out anything we may have written if there was an error.
          */
         (void) ftruncate64(fd, 0);
         free(pgc.pgc_chunk);
+
         return (-1);
 }
 
 static const char *content_str[] = {
         "stack",        /* CC_CONTENT_STACK */