Index: include/stdio.h
===================================================================
--- include/stdio.h
+++ include/stdio.h
@@ -531,4 +531,7 @@
 __END_DECLS
 __NULLABILITY_PRAGMA_POP
 
+#if defined(_FORTIFY_SOURCE) && _FORTIFY_SOURCE > 0
+#include <ssp/stdio.h>
+#endif
 #endif /* !_STDIO_H_ */
Index: include/string.h
===================================================================
--- include/string.h
+++ include/string.h
@@ -170,4 +170,7 @@
 #endif /* __EXT1_VISIBLE */
 __END_DECLS
 
+#if defined(_FORTIFY_SOURCE) && _FORTIFY_SOURCE > 0
+#include <ssp/string.h>
+#endif
 #endif /* _STRING_H_ */
Index: include/strings.h
===================================================================
--- include/strings.h
+++ include/strings.h
@@ -70,4 +70,7 @@
 #endif
 __END_DECLS
 
+#if defined(_FORTIFY_SOURCE) && _FORTIFY_SOURCE > 0
+#include <ssp/strings.h>
+#endif
 #endif /* _STRINGS_H_ */
Index: include/unistd.h
===================================================================
--- include/unistd.h
+++ include/unistd.h
@@ -41,6 +41,10 @@
 #include <sys/_null.h>
 #include <sys/_types.h>
 
+#if defined(_FORTIFY_SOURCE) && _FORTIFY_SOURCE > 0
+#include <ssp/unistd.h>
+#endif
+
 #ifndef _GID_T_DECLARED
 typedef	__gid_t		gid_t;
 #define	_GID_T_DECLARED
@@ -356,7 +360,10 @@
 long	 pathconf(const char *, int);
 int	 pause(void);
 int	 pipe(int *);
+#if !defined(_FORTIFY_SOURCE) || __SSP_FORTIFY_LEVEL == 0
+/* Avoid redeclaration from _FORTIFY_SOURCE */
 ssize_t	 read(int, void *, size_t);
+#endif
 int	 rmdir(const char *);
 int	 setgid(gid_t);
 int	 setpgid(pid_t, pid_t);
Index: lib/libthr/Makefile
===================================================================
--- lib/libthr/Makefile
+++ lib/libthr/Makefile
@@ -10,6 +10,9 @@
 
 .include <src.opts.mk>
 MK_SSP=	no
+# SSP forced off already implies FORTIFY_SOURCE=0, but we must make sure that
+# one cannot turn it back on.
+FORTIFY_SOURCE=	0
 
 LIB=thr
 SHLIB_MAJOR= 3
Index: libexec/rtld-elf/Makefile
===================================================================
--- libexec/rtld-elf/Makefile
+++ libexec/rtld-elf/Makefile
@@ -14,6 +14,10 @@
 MK_SSP=		no
 MK_UBSAN=	no
 
+# SSP forced off already implies FORTIFY_SOURCE=0, but we must make sure that
+# one cannot turn it back on.
+FORTIFY_SOURCE=	0
+
 CONFS=		libmap.conf
 PROG?=		ld-elf.so.1
 .if (${PROG:M*ld-elf32*} != "")
Index: share/mk/bsd.sys.mk
===================================================================
--- share/mk/bsd.sys.mk
+++ share/mk/bsd.sys.mk
@@ -252,10 +252,19 @@
 CXXFLAGS.clang+=	 -Wno-c++11-extensions
 
 .if ${MK_SSP} != "no"
+FORTIFY_SOURCE?=	2
 # Don't use -Wstack-protector as it breaks world with -Werror.
 SSP_CFLAGS?=	-fstack-protector-strong
 CFLAGS+=	${SSP_CFLAGS}
+.else
+FORTIFY_SOURCE?=	0
 .endif # SSP
+.if ${FORTIFY_SOURCE} > 0
+# We default FORTIFY_SOURCE=2 if SSP is enabled, or default it to 0 without.
+# The program or user can tweak it as needed.
+CFLAGS+=	-D_FORTIFY_SOURCE=${FORTIFY_SOURCE}
+CXXFLAGS+=	-D_FORTIFY_SOURCE=${FORTIFY_SOURCE}
+.endif
 
 # Additional flags passed in CFLAGS and CXXFLAGS when MK_DEBUG_FILES is
 # enabled.