Daemons really should be built as PIE where possible, by passing -fpie -pie compile flags. lsexec shows pam_timestamp_check isn't built this way yet.