===== RG: r/backports =====
grsecurity: stable/vserver/testing updates

 - stable:  201404111812            -> 201404131252
 - vserver: vs2.3.2.16-201404111814 -> vs2.3.2.16-201404131253
 - testing: 201404111815            -> 201404131254

Signed-off-by: Austin Seipp <aseipp@pobox.com>
nixos: add a UID for Hydra

Otherwise the Hydra module can't be used when mutableUsers = false;

Signed-off-by: Austin Seipp <aseipp@pobox.com>
Patch python27 for CVE-2014-1912.
Patch python32 for CVE-2014-1912.
===== RG: r/grsecurity =====
grsecurity: Add paxctl, paxmark and stdenv.needsPax to stdenv
spl: Fix compilation with grsecurity's constify plugin and kernels < 3.8
qimageblitz: Mark stack as non-executable (patch taken from Gentoo)

This allows applications such as okular and kolourpaint to run in
grsecurity kernels, which disallow executable stacks by default.
firefox: Add support for grsecurity
chromium: Add support for grsecurity
polkit: Add support for grsecurity
llvm: Add support for grsecurity
gcc: Add support for grsecurity
oraclejdk7: Add support for grsecurity
spidermonkey: Add support for grsecurity
gstreamer: Add support for grsecurity
grub: Add support for grsecurity
mesa-noglu: Add support for grsecurity
ghc: Add support for grsecurity

In this case, we also need to specify compilation flags to mark stacks as
non-executable, otherwise PaX will not allow ghc or binaries built by ghc
to run.  This is what gentoo-hardened does as well.