add an apply-pax-flags utility