tools: work around collision of -O0 and -D_FORTIFY_SOURCE

The former gets enforced by our debug builds, the latter appears to be
not uncommon for certain distros' Python packages. Newer glibc warns on
uses of _FORTIFY_SOURCE without optimization being enabled, which with
-Werror causes the build to fail.

Determine Python's intended flags to be passed to the C compiler via
"python-config --cflags", and replace -O0 by -O1 when a non-zero value
gets set for _FORTIFY_SOURCE.

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>

--- a/tools/pygrub/Makefile
+++ b/tools/pygrub/Makefile
@@ -2,15 +2,24 @@
 XEN_ROOT = $(CURDIR)/../..
 include $(XEN_ROOT)/tools/Rules.mk
 
+py_cflags := $(shell $(PYTHON)-config --cflags)
+PY_CFLAGS = $(if $(strip $(py_cflags)),,\
+                 $(error '$(PYTHON)-config --cflags' produced no output))\
+            $(if $(filter -D_FORTIFY_SOURCE=%,\
+                          $(filter-out -D_FORTIFY_SOURCE=0,\
+                                       $(py_cflags))),\
+                 $(patsubst -O0,-O1,$(CFLAGS)),\
+                 $(CFLAGS)) $(APPEND_LDFLAGS)
+
 .PHONY: all
 all: build
 .PHONY: build
 build:
-	CC="$(CC)" CFLAGS="$(CFLAGS) $(APPEND_LDFLAGS)" $(PYTHON) setup.py build
+	CC="$(CC)" CFLAGS="$(PY_CFLAGS)" $(PYTHON) setup.py build
 
 .PHONY: install
 install: all
-	CC="$(CC)" CFLAGS="$(CFLAGS) $(APPEND_LDFLAGS)" $(PYTHON) setup.py install \
+	CC="$(CC)" CFLAGS="$(PY_CFLAGS)" $(PYTHON) setup.py install \
 		$(PYTHON_PREFIX_ARG) --root="$(DESTDIR)" \
 		--install-scripts=$(LIBEXEC_BIN) --force
 	set -e; if [ $(BINDIR) != $(LIBEXEC_BIN) -a \
--- a/tools/python/Makefile
+++ b/tools/python/Makefile
@@ -4,6 +4,15 @@ include $(XEN_ROOT)/tools/Rules.mk
 .PHONY: all
 all: build
 
+py_cflags := $(shell $(PYTHON)-config --cflags)
+PY_CFLAGS = $(if $(strip $(py_cflags)),,\
+                 $(error '$(PYTHON)-config --cflags' produced no output))\
+            $(if $(filter -D_FORTIFY_SOURCE=%,\
+                          $(filter-out -D_FORTIFY_SOURCE=0,\
+                                       $(py_cflags))),\
+                 $(patsubst -O0,-O1,$(CFLAGS)),\
+                 $(CFLAGS)) $(LDFLAGS) $(APPEND_LDFLAGS)
+
 .PHONY: build
 build: genwrap.py $(XEN_ROOT)/tools/libxl/libxl_types.idl \
 		$(XEN_ROOT)/tools/libxl/idl.py
@@ -11,11 +20,11 @@ build: genwrap.py $(XEN_ROOT)/tools/libx
 		$(XEN_ROOT)/tools/libxl/libxl_types.idl \
 		xen/lowlevel/xl/_pyxl_types.h \
 		xen/lowlevel/xl/_pyxl_types.c
-	CC="$(CC)" CFLAGS="$(CFLAGS) $(LDFLAGS) $(APPEND_LDFLAGS)" $(PYTHON) setup.py build
+	CC="$(CC)" CFLAGS="$(PY_CFLAGS)" $(PYTHON) setup.py build
 
 .PHONY: install
 install:
-	CC="$(CC)" CFLAGS="$(CFLAGS) $(LDFLAGS) $(APPEND_LDFLAGS)" $(PYTHON) setup.py install \
+	CC="$(CC)" CFLAGS="$(PY_CFLAGS)" $(PYTHON) setup.py install \
 		$(PYTHON_PREFIX_ARG) --root="$(DESTDIR)" --force
 
 .PHONY: test