7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

*** 457,468 ****
            ":default" can be used as a token to indicate use of the         pool
  specified in the project(4) entry given in the         "project" attribute
  above.  --> <!ELEMENT method_context    ( (method_profile |
  method_credential)?, method_environment? ) >
  
! <!ATTLIST method_context      working_directory   CDATA #IMPLIED      project
!                CDATA #IMPLIED      resource_pool       CDATA #IMPLIED >
  
  <!-- Restarter delegation, methods, and monitors -->
  
  <!--
    exec_method
--- 457,469 ----
            ":default" can be used as a token to indicate use of the         pool
  specified in the project(4) entry given in the         "project" attribute
  above.  --> <!ELEMENT method_context    ( (method_profile |
  method_credential)?, method_environment? ) >
  
! <!ATTLIST method_context      security_flags      CDATA #IMPLIED
!      working_directory   CDATA #IMPLIED      project             CDATA #IMPLIED
!      resource_pool       CDATA #IMPLIED >
  
  <!-- Restarter delegation, methods, and monitors -->
  
  <!--
    exec_method