7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.

*** 63,79 ****
  int use_stk_lpg = 1;
  
  static int brk_lpg(caddr_t nva);
  static int grow_lpg(caddr_t sp);
  
! int
  brk(caddr_t nva)
  {
          int error;
          proc_t *p = curproc;
  
          /*
           * Serialize brk operations on an address space.
           * This also serves as the lock protecting p_brksize
           * and p_brkpageszc.
           */
          as_rangelock(p->p_as);
--- 63,86 ----
  int use_stk_lpg = 1;
  
  static int brk_lpg(caddr_t nva);
  static int grow_lpg(caddr_t sp);
  
! intptr_t
  brk(caddr_t nva)
  {
          int error;
          proc_t *p = curproc;
  
          /*
+          * As a special case to aid the implementation of sbrk(3C), if given a
+          * new brk of 0, return the current brk.  We'll hide this in brk(3C).
+          */
+         if (nva == 0)
+                 return ((intptr_t)(p->p_brkbase + p->p_brksize));
+ 
+         /*
           * Serialize brk operations on an address space.
           * This also serves as the lock protecting p_brksize
           * and p_brkpageszc.
           */
          as_rangelock(p->p_as);
*** 488,501 ****
          p->p_stksize = newsize;
          return (0);
  }
  
  /*
!  * Find address for user to map.
!  * If MAP_FIXED is not specified, we can pick any address we want, but we will
!  * first try the value in *addrp if it is non-NULL.  Thus this is implementing
!  * a way to try and get a preferred address.
   */
  int
  choose_addr(struct as *as, caddr_t *addrp, size_t len, offset_t off,
      int vacalign, uint_t flags)
  {
--- 495,508 ----
          p->p_stksize = newsize;
          return (0);
  }
  
  /*
!  * Find address for user to map.  If MAP_FIXED is not specified, we can pick
!  * any address we want, but we will first try the value in *addrp if it is
!  * non-NULL and _MAP_RANDOMIZE is not set.  Thus this is implementing a way to
!  * try and get a preferred address.
   */
  int
  choose_addr(struct as *as, caddr_t *addrp, size_t len, offset_t off,
      int vacalign, uint_t flags)
  {
*** 504,514 ****
  
          ASSERT(AS_ISCLAIMGAP(as));      /* searches should be serialized */
          if (flags & MAP_FIXED) {
                  (void) as_unmap(as, *addrp, len);
                  return (0);
!         } else if (basep != NULL && ((flags & MAP_ALIGN) == 0) &&
              !as_gap(as, len, &basep, &lenp, 0, *addrp)) {
                  /* User supplied address was available */
                  *addrp = basep;
          } else {
                  /*
--- 511,522 ----
  
          ASSERT(AS_ISCLAIMGAP(as));      /* searches should be serialized */
          if (flags & MAP_FIXED) {
                  (void) as_unmap(as, *addrp, len);
                  return (0);
!         } else if (basep != NULL &&
!             ((flags & (MAP_ALIGN | _MAP_RANDOMIZE)) == 0) &&
              !as_gap(as, len, &basep, &lenp, 0, *addrp)) {
                  /* User supplied address was available */
                  *addrp = basep;
          } else {
                  /*
*** 610,619 ****
--- 618,640 ----
  
          if ((flags & (MAP_TEXT | MAP_INITDATA)) == (MAP_TEXT | MAP_INITDATA)) {
                  return (EINVAL);
          }
  
+         if ((flags & (MAP_FIXED | _MAP_RANDOMIZE)) ==
+             (MAP_FIXED | _MAP_RANDOMIZE)) {
+                 return (EINVAL);
+         }
+ 
+         /*
+          * If it's not a fixed allocation and mmap ASLR is enabled, randomize
+          * it.
+          */
+         if (((flags & MAP_FIXED) == 0) &&
+             secflag_enabled(curproc, PROC_SEC_ASLR))
+                 flags |= _MAP_RANDOMIZE;
+ 
  #if defined(__sparc)
          /*
           * See if this is an "old mmap call".  If so, remember this
           * fact and convert the flags value given to mmap to indicate
           * the specified address in the system call must be used.
*** 628,638 ****
          if (type != MAP_PRIVATE && type != MAP_SHARED)
                  return (EINVAL);
  
  
          if (flags & MAP_ALIGN) {
- 
                  if (flags & MAP_FIXED)
                          return (EINVAL);
  
                  /* alignment needs to be a power of 2 >= page size */
                  if (((uintptr_t)*addrp < PAGESIZE && (uintptr_t)*addrp != 0) ||
--- 649,658 ----