anchor.diff:    ###### implementation
   
     config = {
  -  
  +
  +    security.setuidPrograms =
  +      [ "passwd" "su" "crontab" "ping" "ping6"
  +        "fusermount" "wodim" "cdrdao" "growisofs"
  +      ];
  +
       system.activationScripts.setuid =
         let
           setuidPrograms =
  
positive.code:   options = {
  
      security.setuidPrograms = mkOption {
        default =
          [ "passwd" "su" "crontab" "ping" "ping6"
            "fusermount" "wodim" "cdrdao" "growisofs"
          ];
        description = ''
          Only the programs from system path listed here will be made
          setuid root (through a wrapper program).
  
negative.code:     name = "setuid-wrapper";
      buildCommand = ''
        ensureDir $out/bin
        gcc -Wall -O2 -DWRAPPER_DIR=\"${wrapperDir}\" \
            ${./setuid-wrapper.c} -o $out/bin/setuid-wrapper
        strip -s $out/bin/setuid-wrapper
      '';
    };
  