Use hardening flags for ipa-optd.

https://fedorahosted.org/freeipa/ticket/4010

daemons/ipa-otpd/Makefile.am

@@ -1,5 +1,5 @@
 AM_CFLAGS := $(CFLAGS) @LDAP_CFLAGS@ @LIBVERTO_CFLAGS@
-AM_LDFLAGS := $(LDFLAGS) @LDAP_LIBS@ @LIBVERTO_LIBS@ @KRAD_LIBS@
+AM_LDFLAGS := $(LDFLAGS) @LDAP_LIBS@ @LIBVERTO_LIBS@ @KRAD_LIBS@ -pie -Wl,-z,relro -Wl,-z,now
 
 noinst_HEADERS = internal.h
 libexec_PROGRAMS = ipa-otpd

freeipa.spec.in

@@ -5,6 +5,10 @@
 %global POLICYCOREUTILSVER 2.1.12-5
 %global gettext_domain ipa
 
+%if (0%{?fedora} > 15 || 0%{?rhel} >= 7)
+%define _hardened_build 1
+%endif
+
 Name:           freeipa
 Version:        __VERSION__
 Release:        __RELEASE__%{?dist}