7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

*** 56,65 ****
--- 56,66 ----
          zonecfg_add_pkg;
          zonecfg_add_pset;
          zonecfg_add_rctl;
          zonecfg_add_rctl_value;
          zonecfg_add_scratch;
+         zonecfg_add_secflags;
          zonecfg_aliased_rctl_ok;
          zonecfg_apply_rctls;
          zonecfg_attach_manifest;
          zonecfg_authorize_users;
          zonecfg_bind_pool;
*** 82,91 ****
--- 83,93 ----
          zonecfg_delete_mcap;
          zonecfg_delete_nwif;
          zonecfg_delete_pset;
          zonecfg_delete_rctl;
          zonecfg_delete_scratch;
+         zonecfg_delete_secflags;
          zonecfg_del_all_resources;
          zonecfg_destroy;
          zonecfg_destroy_snapshot;
          zonecfg_destroy_tmp_pool;
          zonecfg_detached;
*** 135,144 ****
--- 137,147 ----
          zonecfg_get_pool;
          zonecfg_get_poolname;
          zonecfg_get_privset;
          zonecfg_getpsetent;
          zonecfg_getrctlent;
+         zonecfg_getsecflagsent;
          zonecfg_get_root;
          zonecfg_get_sched_class;
          zonecfg_get_scratch;
          zonecfg_get_snapshot_handle;
          zonecfg_get_template_handle;
*** 162,180 ****
--- 165,185 ----
          zonecfg_lookup_filesystem;
          zonecfg_lookup_mcap;
          zonecfg_lookup_nwif;
          zonecfg_lookup_pset;
          zonecfg_lookup_rctl;
+         zonecfg_lookup_secflags;
          zonecfg_modify_admin;
          zonecfg_modify_attr;
          zonecfg_modify_dev;
          zonecfg_modify_ds;
          zonecfg_modify_filesystem;
          zonecfg_modify_mcap;
          zonecfg_modify_nwif;
          zonecfg_modify_pset;
          zonecfg_modify_rctl;
+         zonecfg_modify_secflags;
          zonecfg_notify_bind;
          zonecfg_notify_critical_abort;
          zonecfg_notify_critical_enter;
          zonecfg_notify_critical_exit;
          zonecfg_notify_unbind;