Any chance you'd be willing to accept a patch like this to let the user choose an -fstack-protector variant instead of hardcoding no? The default behaviour is of course unchanged.
If you add a -fstack-protector option to CFLAGS, it will override the default of no. Isn't that enough? -- Laurent