From: Federico Ceratto <federico@debian.org>
Subject: Enable hardening flags

--- a/SConstruct
+++ b/SConstruct
@@ -15,6 +15,7 @@
 werror = int(ARGUMENTS.get("werror", 1))
 clang = int(ARGUMENTS.get("clang", 0))
 argp_standalone = int(ARGUMENTS.get("argp_standalone", 0))
+security = int(ARGUMENTS.get('security', 1))
 sound = False
 
 if profile: debug = 0
@@ -126,6 +127,10 @@
     env.Append(LIBS='openal')
     env.Append(CCFLAGS='-DSOUND=OPENAL')
 
+if security:
+    env.Append(CFLAGS='-Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -fPIE -pie')
+    env.Append(LINKFLAGS='-z relro -z now')
+
 # Append external environment flags
 env.Append(
     CFLAGS=os.environ.get("CFLAGS", "").split(),
