7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

@@ -56,10 +56,11 @@
         zonecfg_add_pkg;
         zonecfg_add_pset;
         zonecfg_add_rctl;
         zonecfg_add_rctl_value;
         zonecfg_add_scratch;
+        zonecfg_add_secflags;
         zonecfg_aliased_rctl_ok;
         zonecfg_apply_rctls;
         zonecfg_attach_manifest;
         zonecfg_authorize_users;
         zonecfg_bind_pool;

@@ -82,10 +83,11 @@
         zonecfg_delete_mcap;
         zonecfg_delete_nwif;
         zonecfg_delete_pset;
         zonecfg_delete_rctl;
         zonecfg_delete_scratch;
+        zonecfg_delete_secflags;
         zonecfg_del_all_resources;
         zonecfg_destroy;
         zonecfg_destroy_snapshot;
         zonecfg_destroy_tmp_pool;
         zonecfg_detached;

@@ -135,10 +137,11 @@
         zonecfg_get_pool;
         zonecfg_get_poolname;
         zonecfg_get_privset;
         zonecfg_getpsetent;
         zonecfg_getrctlent;
+        zonecfg_getsecflagsent;
         zonecfg_get_root;
         zonecfg_get_sched_class;
         zonecfg_get_scratch;
         zonecfg_get_snapshot_handle;
         zonecfg_get_template_handle;

@@ -162,19 +165,21 @@
         zonecfg_lookup_filesystem;
         zonecfg_lookup_mcap;
         zonecfg_lookup_nwif;
         zonecfg_lookup_pset;
         zonecfg_lookup_rctl;
+        zonecfg_lookup_secflags;
         zonecfg_modify_admin;
         zonecfg_modify_attr;
         zonecfg_modify_dev;
         zonecfg_modify_ds;
         zonecfg_modify_filesystem;
         zonecfg_modify_mcap;
         zonecfg_modify_nwif;
         zonecfg_modify_pset;
         zonecfg_modify_rctl;
+        zonecfg_modify_secflags;
         zonecfg_notify_bind;
         zonecfg_notify_critical_abort;
         zonecfg_notify_critical_enter;
         zonecfg_notify_critical_exit;
         zonecfg_notify_unbind;