Most secure PaX configuration for a binary?