===== RG: r/grsecurity =====
grsecurity: Add paxctl, paxmark and stdenv.needsPax to stdenv
spl: Fix compilation with grsecurity's constify plugin and kernels < 3.8
qimageblitz: Mark stack as non-executable (patch taken from Gentoo)

This allows applications such as okular and kolourpaint to run in
grsecurity kernels, which disallow executable stacks by default.
firefox: Add support for grsecurity
chromium: Add support for grsecurity
polkit: Add support for grsecurity
llvm: Add support for grsecurity
gcc: Add support for grsecurity
oraclejdk7: Add support for grsecurity
spidermonkey: Add support for grsecurity
gstreamer: Add support for grsecurity
grub: Add support for grsecurity
mesa-noglu: Add support for grsecurity
ghc: Add support for grsecurity

In this case, we also need to specify compilation flags to mark stacks as
non-executable, otherwise PaX will not allow ghc or binaries built by ghc
to run.  This is what gentoo-hardened does as well.
openjdkBootstrap: Add support for grsecurity
mesa: use grsec at build time, override at run time

This is needed for grsecurity kernels to be able to build stuff (e.g. pango).
With grsec the libGL is slower, but we don't care much at build time,
so we can share binaries among grsec and nogrsec.

This adds 2-3 MB to nogrsec closures that use mesa drivers (libGL is doubled).
===== RG: r/xxx-grsec-wip =====
XXX grsecurity workaround - don't set kptr_restrict sysctl
XXX systemd: disable systemd-inhibit due to grsecurity