diff --git a/cddl/Makefile.inc b/cddl/Makefile.inc
--- a/cddl/Makefile.inc
+++ b/cddl/Makefile.inc
@@ -5,6 +5,7 @@
 IGNORE_PRAGMA=	YES
 
 CFLAGS+=	-DNEED_SOLARIS_BOOLEAN
+CFLAGS+=	-DHAVE_STRLCAT -DHAVE_STRLCPY
 
 # Do not lint the CDDL stuff. It is all externally maintained and
 # lint output is wasteful noise here.
diff --git a/include/ssp/ssp.h b/include/ssp/ssp.h
--- a/include/ssp/ssp.h
+++ b/include/ssp/ssp.h
@@ -36,7 +36,7 @@
 
 #include <sys/cdefs.h>
 
-#if !defined(__cplusplus)
+#if !defined(__cplusplus) && !defined(_KERNEL)
 # if defined(_FORTIFY_SOURCE) && _FORTIFY_SOURCE > 0 && \
      (__OPTIMIZE__ > 0 || defined(__clang__))
 #  if _FORTIFY_SOURCE > 1
diff --git a/lib/libbe/Makefile b/lib/libbe/Makefile
--- a/lib/libbe/Makefile
+++ b/lib/libbe/Makefile
@@ -61,7 +61,7 @@
 CFLAGS+= -I${SRCTOP}/sys
 CFLAGS+= -I${SRCTOP}/cddl/compat/opensolaris/include
 CFLAGS+= -include ${SRCTOP}/sys/contrib/openzfs/include/os/freebsd/spl/sys/ccompile.h
-CFLAGS+= -DHAVE_ISSETUGID
+CFLAGS+= -DHAVE_ISSETUGID -DHAVE_STRLCAT -DHAVE_STRLCPY
 CFLAGS.be.c=		-Wno-cast-qual
 CFLAGS.be_access.c=	-Wno-cast-qual
 CFLAGS.be_error.c=	-Wno-cast-qual
diff --git a/lib/libproc/Makefile b/lib/libproc/Makefile
--- a/lib/libproc/Makefile
+++ b/lib/libproc/Makefile
@@ -24,7 +24,7 @@
 CFLAGS+= -I${SRCTOP}/sys/contrib/openzfs/lib/libspl/include/
 CFLAGS+= -I${SRCTOP}/sys/contrib/openzfs/lib/libspl/include/os/freebsd
 CFLAGS+= -include ${SRCTOP}/sys/contrib/openzfs/include/os/freebsd/spl/sys/ccompile.h
-CFLAGS+= -DHAVE_ISSETUGID -DHAVE_BOOLEAN
+CFLAGS+= -DHAVE_ISSETUGID -DHAVE_BOOLEAN -DHAVE_STRLCAT -DHAVE_STRLCPY
 CFLAGS+=	-I${SRCTOP}/cddl/contrib/opensolaris/lib/libctf/common \
 		-I${SRCTOP}/sys/cddl/contrib/opensolaris/uts/common \
 		-I${SRCTOP}/sys/cddl/compat/opensolaris
diff --git a/sbin/bectl/Makefile b/sbin/bectl/Makefile
--- a/sbin/bectl/Makefile
+++ b/sbin/bectl/Makefile
@@ -22,7 +22,7 @@
 CFLAGS+= -I${SRCTOP}/cddl/compat/opensolaris/include
 CFLAGS+= -I${SRCTOP}/sys/contrib/openzfs/module/icp/include
 CFLAGS+= -include ${SRCTOP}/sys/contrib/openzfs/include/os/freebsd/spl/sys/ccompile.h
-CFLAGS+= -DHAVE_ISSETUGID 
+CFLAGS+= -DHAVE_ISSETUGID -DHAVE_STRLCAT -DHAVE_STRLCPY
 CFLAGS+= -include ${SRCTOP}/sys/modules/zfs/zfs_config.h
 
 HAS_TESTS=	yes
diff --git a/stand/defs.mk b/stand/defs.mk
--- a/stand/defs.mk
+++ b/stand/defs.mk
@@ -2,6 +2,8 @@
 .if !defined(__BOOT_DEFS_MK__)
 __BOOT_DEFS_MK__=${MFILE}
 
+FORTIFY_SOURCE=	0
+
 # We need to define all the MK_ options before including src.opts.mk
 # because it includes bsd.own.mk which needs the right MK_ values,
 # espeically MK_CTF.
diff --git a/stand/libsa/Makefile b/stand/libsa/Makefile
--- a/stand/libsa/Makefile
+++ b/stand/libsa/Makefile
@@ -195,7 +195,7 @@
 
 # Create a subset of includes that are safe, as well as adjusting those that aren't
 # The lists may drive people nuts, but they are explicitly opt-in
-FAKE_DIRS=xlocale arpa
+FAKE_DIRS=xlocale arpa ssp
 SAFE_INCS=a.out.h assert.h elf.h inttypes.h limits.h nlist.h setjmp.h stddef.h stdbool.h string.h strings.h time.h unistd.h uuid.h
 STAND_H_INC=ctype.h fcntl.h signal.h stdio.h stdlib.h
 OTHER_INC=stdarg.h errno.h stdint.h
@@ -210,6 +210,7 @@
 	ln -sf ${SYSDIR}/sys/stdint.h stdint.h; \
 	ln -sf ${SRCTOP}/include/arpa/inet.h arpa/inet.h; \
 	ln -sf ${SRCTOP}/include/arpa/tftp.h arpa/tftp.h; \
+	ln -sf ${SRCTOP}/include/ssp/ssp.h ssp/ssp.h; \
 	for i in _time.h _strings.h _string.h; do \
 		[ -f xlocale/$$i ] || :> xlocale/$$i; \
 	done; \