7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

@@ -267,10 +267,11 @@
         preadv.o                \
         priocntlset.o           \
         processor_bind.o        \
         processor_info.o        \
         profil.o                \
+        psecflagsset.o          \
         putmsg.o                \
         putpmsg.o               \
         pwrite.o                \
         pwritev.o               \
         read.o                  \

@@ -517,10 +518,11 @@
         posix_madvise.o         \
         posix_memalign.o        \
         priocntl.o              \
         privlib.o               \
         priv_str_xlate.o        \
+        psecflags.o             \
         psiginfo.o              \
         psignal.o               \
         pt.o                    \
         putpwent.o              \
         putspent.o              \

@@ -828,10 +830,13 @@
         sched.o                 \
         sem.o                   \
         shm.o                   \
         sigev_thread.o
 
+SECFLAGSOBJS=                   \
+        secflags.o
+
 TPOOLOBJS=                      \
         thread_pool.o
 
 THREADSOBJS=                    \
         alloc.o                 \

@@ -975,10 +980,11 @@
         $(PORTSTDIO_W)          \
         $(PORTSYS)              \
         $(PORTSYS64)            \
         $(AIOOBJS)              \
         $(RTOBJS)               \
+        $(SECFLAGSOBJS)         \
         $(TPOOLOBJS)            \
         $(THREADSOBJS)          \
         $(THREADSMACHOBJS)      \
         $(THREADSASMOBJS)       \
         $(UNICODEOBJS)          \

@@ -1107,10 +1113,11 @@
         $(PORTREGEX:%.o=$(LIBCDIR)/port/regex/%.c)              \
         $(PORTSTDIO:%.o=$(LIBCDIR)/port/stdio/%.c)              \
         $(PORTSYS:%.o=$(LIBCDIR)/port/sys/%.c)                  \
         $(AIOOBJS:%.o=$(LIBCDIR)/port/aio/%.c)                  \
         $(RTOBJS:%.o=$(LIBCDIR)/port/rt/%.c)                    \
+        $(SECFLAGSOBJS:%.o=$(SRC)/common/secflags/%.c)          \
         $(TPOOLOBJS:%.o=$(LIBCDIR)/port/tpool/%.c)              \
         $(THREADSOBJS:%.o=$(LIBCDIR)/port/threads/%.c)          \
         $(THREADSMACHOBJS:%.o=$(LIBCDIR)/$(MACH)/threads/%.c)   \
         $(UNICODEOBJS:%.o=$(SRC)/common/unicode/%.c)    \
         $(UNWINDMACHOBJS:%.o=$(LIBCDIR)/port/unwind/%.c)        \