7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

*** 107,116 ****
--- 107,119 ----
          strtoull.o
  
  DTRACEOBJS=                     \
          dtrace_data.o
  
+ SECFLAGSOBJS=                   \
+         secflags.o
+ 
  GENOBJS=                        \
          _div64.o                \
          _divdi3.o               \
          _getsp.o                \
          _mul64.o                \
*** 263,272 ****
--- 266,276 ----
          preadv.o                \
          priocntlset.o           \
          processor_bind.o        \
          processor_info.o        \
          profil.o                \
+         psecflagsset.o          \
          putmsg.o                \
          putpmsg.o               \
          pwrite.o                \
          pwritev.o               \
          read.o                  \
*** 524,533 ****
--- 528,538 ----
          posix_madvise.o         \
          posix_memalign.o        \
          priocntl.o              \
          privlib.o               \
          priv_str_xlate.o        \
+         psecflags.o             \
          psiginfo.o              \
          psignal.o               \
          pt.o                    \
          putpwent.o              \
          putspent.o              \
*** 999,1008 ****
--- 1004,1014 ----
          $(PORTSTDIO_W)          \
          $(PORTSYS)              \
          $(PORTSYS64)            \
          $(AIOOBJS)              \
          $(RTOBJS)               \
+         $(SECFLAGSOBJS)         \
          $(TPOOLOBJS)            \
          $(THREADSOBJS)          \
          $(THREADSMACHOBJS)      \
          $(THREADSASMOBJS)       \
          $(UNICODEOBJS)          \
*** 1148,1157 ****
--- 1154,1164 ----
          $(PORTREGEX:%.o=$(LIBCDIR)/port/regex/%.c)              \
          $(PORTSTDIO:%.o=$(LIBCDIR)/port/stdio/%.c)              \
          $(PORTSYS:%.o=$(LIBCDIR)/port/sys/%.c)                  \
          $(AIOOBJS:%.o=$(LIBCDIR)/port/aio/%.c)                  \
          $(RTOBJS:%.o=$(LIBCDIR)/port/rt/%.c)                    \
+         $(SECFLAGSOBJS:%.o=$(SRC)/common/secflags/%.c)          \
          $(TPOOLOBJS:%.o=$(LIBCDIR)/port/tpool/%.c)              \
          $(THREADSOBJS:%.o=$(LIBCDIR)/port/threads/%.c)          \
          $(THREADSMACHOBJS:%.o=$(LIBCDIR)/$(MACH)/threads/%.c)   \
          $(UNICODEOBJS:%.o=$(SRC)/common/unicode/%.c)    \
          $(UNWINDMACHOBJS:%.o=$(LIBCDIR)/port/unwind/%.c)        \