xt_pax should be used, both pt_pax and xt_pax should be used only for migration to xt_pax
also, use hardened sources when building a hardened image