* debian/rules: Do not hard-code CFLAGS and LDFLAGS. Build with all

hardening flags set. Closes: #657010

debian/rules

@@ -8,6 +8,16 @@ ifeq ($(DEB_HOST_ARCH_OS),hurd)
 override DEB_ARCH_PACKAGES=passwd
 endif
 
+# To be set before loading any CDBS files (#651964)
+#CDBS_FIX_COMPILE_FLAGS = 1
+# Enable PIE, BINDNOW, and possible future flags.
+#export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+# Unfortunately, this is not working (#651966), set flags manually
+
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+DPKG_EXPORT_BUILDFLAGS = 1
+include /usr/share/dpkg/buildflags.mk
+
 include /usr/share/cdbs/1/rules/debhelper.mk
 # Specify where dh_install will find the files that it needs to move:
 DEB_DH_INSTALL_SOURCEDIR=debian/tmp
@@ -32,14 +42,6 @@ endif
 # Automatically controls patching at build time:
 include /usr/share/cdbs/1/rules/patchsys-quilt.mk
 
-CFLAGS = -g -W -Wall
-ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
-  CFLAGS += -O0
-else
-  CFLAGS += -O2
-endif
-export CFLAGS
-
 # Add extras to the install process:
 binary-install/login::
 	dh_installpam -p login