The cross-i686-pc-linux-gnu pkg uses gcc-4.7.x and does not support -fstack-protector-strong, so use a more relaxed approach for now.
Rather than setting them in the build profile, just set them in etc/defaults.conf (overridable via etc/conf) to simplify the code. - Also enable _FORTIFY_SOURCE=2 in CPPFLAGS. - Also enable -z,relro in LDFLAGS. As suggested by @chneukirchen.