Hey while I'm sitting here staring at it, here's something I think is pretty useful. It's a late descendant from all those non-executeable stack patches for gcc so you can build somewhat hardened binaries if you're not chronically addicted to rpms. This one seems to be the most reasonable to work with that I've seen as well. It doesn't require you to keep older copies of your compiler around, since you tell it to build protected binaries with a new -f argument (usually passed through CFLAGS).

GCC extension for protecting applications from stack-smashing attacks