7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

*** 134,143 ****
--- 134,146 ----
          strtoull.o
  
  DTRACEOBJS=                     \
          dtrace_data.o
  
+ SECFLAGSOBJS=                   \
+         secflags.o
+ 
  GENOBJS=                        \
          _getsp.o                \
          _xregs_clrptr.o         \
          abs.o                   \
          alloca.o                \
*** 283,292 ****
--- 286,296 ----
          preadv.o                \
          priocntlset.o           \
          processor_bind.o        \
          processor_info.o        \
          profil.o                \
+         psecflagsset.o          \
          putmsg.o                \
          putpmsg.o               \
          pwrite.o                \
          pwritev.o               \
          read.o                  \
*** 556,565 ****
--- 560,570 ----
          posix_madvise.o         \
          posix_memalign.o        \
          priocntl.o              \
          privlib.o               \
          priv_str_xlate.o        \
+         psecflags.o             \
          psiginfo.o              \
          psignal.o               \
          pt.o                    \
          putpwent.o              \
          putspent.o              \
*** 1036,1045 ****
--- 1041,1051 ----
          $(PORTSTDIO_W)          \
          $(PORTSYS)              \
          $(PORTSYS64)            \
          $(AIOOBJS)              \
          $(RTOBJS)               \
+         $(SECFLAGSOBJS)         \
          $(TPOOLOBJS)            \
          $(THREADSOBJS)          \
          $(THREADSMACHOBJS)      \
          $(THREADSASMOBJS)       \
          $(UNICODEOBJS)          \
*** 1178,1187 ****
--- 1184,1194 ----
          $(PORTREGEX:%.o=$(LIBCDIR)/port/regex/%.c)              \
          $(PORTSTDIO:%.o=$(LIBCDIR)/port/stdio/%.c)              \
          $(PORTSYS:%.o=$(LIBCDIR)/port/sys/%.c)                  \
          $(AIOOBJS:%.o=$(LIBCDIR)/port/aio/%.c)                  \
          $(RTOBJS:%.o=$(LIBCDIR)/port/rt/%.c)                    \
+         $(SECFLAGSOBJS:%.o=$(SRC)/common/secflags/%.c)          \
          $(TPOOLOBJS:%.o=$(LIBCDIR)/port/tpool/%.c)              \
          $(THREADSOBJS:%.o=$(LIBCDIR)/port/threads/%.c)          \
          $(THREADSMACHOBJS:%.o=$(LIBCDIR)/$(MACH)/threads/%.c)   \
          $(UNICODEOBJS:%.o=$(SRC)/common/unicode/%.c)    \
          $(UNWINDMACHOBJS:%.o=$(LIBCDIR)/port/unwind/%.c)        \