use hardened CFLAGS/LDFLAGS