Explicitly handle `dont*` and friends not being defined.
This should fix the OpenJDK build, which was failing because paxctl is in sbin and therefore not automatically added to $PATH. http://hydra.nixos.org/build/15658346