diff -u nas-1.9.3/debian/rules nas-1.9.3/debian/rules
--- nas-1.9.3/debian/rules
+++ nas-1.9.3/debian/rules
@@ -7,6 +7,17 @@
 DEB_BUILD_ARCH_OS	?= $(shell dpkg-architecture -qDEB_BUILD_ARCH_OS)
 DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
 
+LDFLAGS_DEF = `dpkg-buildflags --get LDFLAGS`
+CPPFLAGS_DEF = `dpkg-buildflags --get CPPFLAGS`
+CFLAGS_DEF = `dpkg-buildflags --get CFLAGS`
+
+ifeq (,$(filter nostrip,$(DEB_BUILD_OPTIONS)))
+	LDFLAGS_DEF += -s
+endif
+ifneq (,$(filter noopt,$(DEB_BUILD_OPTIONS)))
+	CFLAGS_DEF += -O0
+endif
+
 package=nas
 instdirs=BINDIR=/usr/bin USRLIBDIR=/usr/lib/$(DEB_HOST_MULTIARCH) MANPATH=/usr/share/man INCDIR=/usr/include MANSUFFIX=1nas LIBMANSUFFIX=3nas FILEMANSUFFIX=5nas ETCDIR=/etc/nas
 
@@ -25,7 +36,10 @@
 	( cd include/audio; for file in ../../lib/audio/*.h; do ln -s $$file .; done )
 	cp /usr/share/misc/config.sub config
 	xmkmf -a
-	$(MAKE) LDFLAGS="-s"
+	$(MAKE) EXTRA_LDOPTIONS="$(LDFLAGS_DEF)" \
+		CCOPTIONS="$(CFLAGS_DEF) $(CPPFLAGS_DEF)" \
+		INSTALL_FLAGS="$(INSTALL_FLAGS)" \
+		LDFLAGS_DEF="$(LDFLAGS_DEF)"
 	touch build
 
 clean:
@@ -114,13 +128,17 @@
 	chmod 644 debian/nas/usr/share/doc/nas/examples/nasd.conf.eg
 	chmod 755 debian/nas/etc/nas
 	chmod 755 debian/nas/etc/default
+ifeq (,$(filter nostrip,$(DEB_BUILD_OPTIONS)))
 	file debian/nas/usr/bin/* | grep executable | grep -v 'text executable' | cut -d':' -f1 | xargs strip --strip-unneeded --remove-section=.comment --remove-section=.note
 endif
+endif
 
 	# install nas-bin
 	(top=`pwd`; cd clients/audio && $(MAKE) install $(instdirs) DESTDIR=$$top/debian/nas-bin)
 	(top=`pwd`; cd clients/audio && $(MAKE) install.man $(instdirs) DESTDIR=$$top/debian/nas-bin)
+ifeq (,$(filter nostrip,$(DEB_BUILD_OPTIONS)))
 	file debian/nas-bin/usr/bin/* | grep executable | grep -v 'text executable' | cut -d':' -f1 | xargs strip --strip-unneeded --remove-section=.comment --remove-section=.note
+endif
 
 	# install libaudio-dev
 	(top=`pwd`; cd doc/man/lib && $(MAKE) install.man $(instdirs) MANSUFFIX=3nas DESTDIR=$$top/debian/libaudio-dev)
@@ -134,7 +152,9 @@
 	install -m644 lib/audio/libaudio.so.2.4 debian/libaudio2/usr/lib/$(DEB_HOST_MULTIARCH)
 	ln -s libaudio.so.2.4 debian/libaudio2/usr/lib/$(DEB_HOST_MULTIARCH)/libaudio.so.2
 	install -m644 lib/audio/libaudio.so.2.4 debian/libaudio2/usr/lib/$(DEB_HOST_MULTIARCH)
+ifeq (,$(filter nostrip,$(DEB_BUILD_OPTIONS)))
 	strip --strip-unneeded --remove-section=.comment --remove-section=.note debian/libaudio2/usr/lib/$(DEB_HOST_MULTIARCH)/libaudio.so.2.4 
+endif
 
 	# Install other files
 	install -m 644 debian/nas.default debian/nas/etc/default/nas
diff -u nas-1.9.3/debian/changelog nas-1.9.3/debian/changelog
--- nas-1.9.3/debian/changelog
+++ nas-1.9.3/debian/changelog
@@ -1,3 +1,18 @@
+nas (1.9.3-3) unstable; urgency=low
+
+  * Tweak hardening flags more to add linker options. Closes: #656857
+  * Add support for DEB_BUILD_OPTS (nostrip and noopt)
+
+ -- Steve McIntyre <93sam@debian.org>  Sun, 22 Jan 2012 14:09:16 +0000
+
+nas (1.9.3-2) unstable; urgency=low
+
+  * Enable hardening flags through dpkg-buildflags. Closes: #655743
+  * Fix string handling in aulog.c:osLogMsg() to fix missing format string
+    in call to syslog().
+
+ -- Steve McIntyre <93sam@debian.org>  Sat, 21 Jan 2012 22:07:21 +0000
+
 nas (1.9.3-1) unstable; urgency=low
 
   * New upstream version.
diff -u nas-1.9.3/lib/audio/Imakefile nas-1.9.3/lib/audio/Imakefile
--- nas-1.9.3/lib/audio/Imakefile
+++ nas-1.9.3/lib/audio/Imakefile
@@ -151,7 +151,7 @@
 #endif
 
 #if defined(LinuxArchitecture) || defined(GNUArchitecture) || defined(SunArchitecture) || defined(__FreeBSD_kernel__) || defined(DarwinArchitecture)
-REQUIREDLIBS = -L$(USRLIBDIR) -lXt $(XAULIB) -lm 
+REQUIREDLIBS = -L$(USRLIBDIR) -lXt $(XAULIB) -lm  $(LDFLAGS_DEF)
 #endif
 
 #if defined(cygwinArchitecture)
only in patch2:
unchanged:
--- nas-1.9.3.orig/server/os/aulog.c
+++ nas-1.9.3/server/os/aulog.c
@@ -37,7 +37,7 @@
 
     if (NasConfig.DoDaemon) {   /* daemons use syslog */
         openlog("nas", LOG_PID, LOG_DAEMON);
-        syslog(LOG_DEBUG, buf);
+        syslog(LOG_DEBUG, "%s", buf);
         closelog();
     } else {
         errfd = stderr;