Harden the build the hard way

polkit.spec

@@ -6,7 +6,7 @@
 Summary: polkit Authorization Framework
 Name: polkit
 Version: 0.109
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: LGPLv2+
 URL: http://www.freedesktop.org/wiki/Software/polkit
 Source0: http://www.freedesktop.org/software/polkit/releases/%{name}-%{version}.tar.gz
@@ -84,6 +84,10 @@ Meta-package for JavaScript engine used by polkit.
 %if 0%{?enable_autoreconf}
 autoreconf
 %endif
+# we can't use _hardened_build here, see
+# https://bugzilla.redhat.com/show_bug.cgi?id=892837
+export CFLAGS='-fPIC %optflags'
+export LDFLAGS='-pie -Wl,-z,now -Wl,-z,relro'
 %configure --enable-gtk-doc \
         --disable-static \
         --enable-introspection \
@@ -160,6 +164,9 @@ exit 0
 %{_datadir}/doc/polkit-js-engine-%{version}/README
 
 %changelog
+* Mon Jan  7 2013 Matthias Clasen <mclasen@redhat.com> - 0.109-2%{?dist}
+- Build with pie and stuff
+
 * Wed Dec 19 2012 David Zeuthen <davidz@redhat.com> 0.109-1%{?dist}
 - Update to upstream release 0.109
 - Drop upstreamed patches