Ingo's lsexec script shows that exec-shield is disabled in httpd because libgmp (picked up via PHP) doesn't have the correct object file markings, doubtless in the assembler... (httpd) 22401 (bff6d000 ): execshield disabled => /usr/lib/libgmp.so.3.3.2 disables exec-shield! can the markings be added to the assembler, presuming that gmp really doesn't require an executable stack?
Oh, actually I think I can do this myself... export CCAS="gcc -c -Wa,--execstack" wasn't so hard - I'll commit the changes.