===== RG: r/zfs-import =====
zfs: Fix libblkid detection (backport from upstream)

This fixes issues with importing ZFS pools, such as when the ZFS device is a
partition that covers the end of the disk.

See: https://github.com/zfsonlinux/zfs/issues/1684
zfs: Don't look for devices only in /dev

If we don't give out a directory to 'zpool import', it will use libblkid
to automatically find all existing ZFS devices.
zfs: Fix minor filesystem corruption with gcc 4.8

It turns out that some of gcc 4.8's aggressive optimizations may
cause minor filesystem corruption in ZFS. To fix it, a patch was
cherry-picked from the upstream's git tree.

See: https://github.com/zfsonlinux/zfs/pull/2051
===== RG: r/grsecurity =====
paxctl: Use http instead of https

This is needed since paxctl is going to be added to stdenv but
early stdenv curl does not support https.
grsecurity: Add paxctl, paxmark and stdenv.needsPax to stdenv
spl: Fix compilation with grsecurity's constify plugin and kernels < 3.8
qimageblitz: Mark stack as non-executable (patch taken from Gentoo)

This allows applications such as okular and kolourpaint to run in
grsecurity kernels, which disallow executable stacks by default.
firefox: Add support for grsecurity
chromium: Add support for grsecurity
polkit: Add support for grsecurity
llvm: Add support for grsecurity
gcc: Add support for grsecurity
oraclejdk7: Add support for grsecurity
spidermonkey: Add support for grsecurity
gstreamer: Add support for grsecurity
grub: Add support for grsecurity
mesa-noglu: Add support for grsecurity
ghc: Add support for grsecurity

In this case, we also need to specify compilation flags to mark stacks as
non-executable, otherwise PaX will not allow ghc or binaries built by ghc
to run.  This is what gentoo-hardened does as well.