See http://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags