A list of things to do:

* remove paxonly switch and make it get set when --without grsec is set and
  --without pax is not set
* remove dgrsec and paxrel from release strings on the stable tree
* remove release string on vanilla kernels
* add switch to spec file which turns CONFIG_GRKERNSEC_HIDESYM back on
* enable CONFIG_GRKERNSEC_SYSCTL_ON and add switch to turn it off
* have the %post and %preun scripts conditionally call SuSE, Mandrivia, and
  other RPM based distribution grub/lilo update scripts on installation if
  they exist, and automatically make sure a initrd.img gets created
* build policy RPMs which depends on gradm
* build binutils RPM (with pax changes)
* upgrade the createrepo package on this server and generate .sqlite files
  along with the rest of the yum repodata