We RPM packaging system need to use optflags for secure building, and of course will override the flags you've defined.
However the current one is not good, we should leave it to the end of the flags queue.
[rpmaker@fab SPECS]$ rpm -E %{optflags}
-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m32 -march=i686 -mtune=atom -fasynchronous-unwind-tables
