7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

*** 267,276 ****
--- 267,277 ----
          preadv.o                \
          priocntlset.o           \
          processor_bind.o        \
          processor_info.o        \
          profil.o                \
+         psecflagsset.o          \
          putmsg.o                \
          putpmsg.o               \
          pwrite.o                \
          pwritev.o               \
          read.o                  \
*** 517,526 ****
--- 518,528 ----
          posix_madvise.o         \
          posix_memalign.o        \
          priocntl.o              \
          privlib.o               \
          priv_str_xlate.o        \
+         psecflags.o             \
          psiginfo.o              \
          psignal.o               \
          pt.o                    \
          putpwent.o              \
          putspent.o              \
*** 828,837 ****
--- 830,842 ----
          sched.o                 \
          sem.o                   \
          shm.o                   \
          sigev_thread.o
  
+ SECFLAGSOBJS=                   \
+         secflags.o
+ 
  TPOOLOBJS=                      \
          thread_pool.o
  
  THREADSOBJS=                    \
          alloc.o                 \
*** 975,984 ****
--- 980,990 ----
          $(PORTSTDIO_W)          \
          $(PORTSYS)              \
          $(PORTSYS64)            \
          $(AIOOBJS)              \
          $(RTOBJS)               \
+         $(SECFLAGSOBJS)         \
          $(TPOOLOBJS)            \
          $(THREADSOBJS)          \
          $(THREADSMACHOBJS)      \
          $(THREADSASMOBJS)       \
          $(UNICODEOBJS)          \
*** 1107,1116 ****
--- 1113,1123 ----
          $(PORTREGEX:%.o=$(LIBCDIR)/port/regex/%.c)              \
          $(PORTSTDIO:%.o=$(LIBCDIR)/port/stdio/%.c)              \
          $(PORTSYS:%.o=$(LIBCDIR)/port/sys/%.c)                  \
          $(AIOOBJS:%.o=$(LIBCDIR)/port/aio/%.c)                  \
          $(RTOBJS:%.o=$(LIBCDIR)/port/rt/%.c)                    \
+         $(SECFLAGSOBJS:%.o=$(SRC)/common/secflags/%.c)          \
          $(TPOOLOBJS:%.o=$(LIBCDIR)/port/tpool/%.c)              \
          $(THREADSOBJS:%.o=$(LIBCDIR)/port/threads/%.c)          \
          $(THREADSMACHOBJS:%.o=$(LIBCDIR)/$(MACH)/threads/%.c)   \
          $(UNICODEOBJS:%.o=$(SRC)/common/unicode/%.c)    \
          $(UNWINDMACHOBJS:%.o=$(LIBCDIR)/port/unwind/%.c)        \