anchor.diff:  {
     boot = {
       blacklistedKernelModules = [
  -      # Obscure network protocols
  +      "adfs"
  +      "af_802154"
  +      "affs"
  +      "appletalk"
  +      "atm"
         "ax25"
  -      "netrom"
  -      "rose"
  -
  -      # Old or rare or insufficiently audited filesystems
  -      "adfs"
  -      "affs"
  +      "befs"
         "bfs"
  -      "befs"
  +      "bluetoth"
  +      "btusb"
  +      "can"
  +      "cifs"
         "cramfs"
  +      "dccp"
  +      "decnet"
  +      "econet"
         "efs"
         "erofs"
         "exofs"
  +      "f2fs"
         "freevxfs"
  -      "f2fs"
  +      "gfs2"
         "hfs"
  +      "hfsplus"
         "hpfs"
  +      "ipx"
  +      "jffs2"
         "jfs"
         "minix"
  +      "n-hdlc"
  +      "netrom"
  +      "nfs"
  +      "nfsv3"
  +      "nfsv4"
         "nilfs2"
         "ntfs"
         "omfs"
  +      "p8022"
  +      "p8023"
  +      "psnap"
         "qnx4"
         "qnx6"
  +      "rds"
  +      "rose"
  +      "sctp"
  +      "squashfs"
         "sysv"
  +      "tipc"
  +      "udf"
         "ufs"
  +      "uvcvideo"
  +      "vivid"
  +      "x25"
       ];
   
       initrd.kernelModules = lib.unique ([
  
positive.code:     kernelPackages = lib.mkForce pkgs.linuxPackages_latest_hardened;
  
      kernelParams = [
        "nohibernate" # Disable hibernation
        "page_alloc.shuffle=1" # Enable page allocator randomization
        "page_poison=1" # Poison memory pages, wiping freed memory
        "pti=on" # Kernel page isolation
        "slab_nomerge" # Disable slab merging (Slab = chunk of memory)
        "slub_debug=FZP" # Enable sanity checks (F), redzoning (Z) and poisoning (P)
        "random.trust_cpu=off" # Enable or disable trusting the use of the CPU's random number generator
        "vsyscall=none" # vsyscall is obsolete
      ];
  
    };
  
negative.code:     kernel.sysctl = {
        "dev.tty.ldisc_autoload" = 0; # Prevent loading vulnerable line disciplines
  
        "fs.protected_fifos" = 2; # Prevent FIFOs in world-writable environments
        "fs.protected_regular" = 2; # Prevent files in world-writable environments
        "fs.protected_symlinks" = 1; # Limit access to links
        "fs.protected_hardlinks" = 1; # Limit access to links
  
  