Rather than setting them in the build profile, just set them in etc/defaults.conf (overridable via etc/conf) to simplify the code. - Also enable _FORTIFY_SOURCE=2 in CPPFLAGS. - Also enable -z,relro in LDFLAGS. As suggested by @chneukirchen.