anchor.diff:      }:
       assert (lib.versionAtLeast (lib.getVersion config.boot.kernelPackages.kernel) "4.3");
       ''
  -      cp ${securityWrapper}/bin/security-wrapper $wrapperDir/${program}
  -      echo -n "${source}" > $wrapperDir/${program}.real
  +      cp ${securityWrapper}/bin/security-wrapper "$wrapperDir/${program}"
  +      echo -n "${source}" > "$wrapperDir/${program}.real"
   
         # Prevent races
  -      chmod 0000 $wrapperDir/${program}
  -      chown ${owner}.${group} $wrapperDir/${program}
  +      chmod 0000 "$wrapperDir/${program}"
  +      chown ${owner}.${group} "$wrapperDir/${program}"
   
         # Set desired capabilities on the file plus cap_setpcap so
         # the wrapper program can elevate the capabilities set on
         # its file into the Ambient set.
  -      ${pkgs.libcap.out}/bin/setcap "cap_setpcap,${capabilities}" $wrapperDir/${program}
  +      ${pkgs.libcap.out}/bin/setcap "cap_setpcap,${capabilities}" "$wrapperDir/${program}"
   
         # Set the executable bit
  -      chmod ${permissions} $wrapperDir/${program}
  +      chmod ${permissions} "$wrapperDir/${program}"
       '';
   
     ###### Activation script for the setuid wrappers
  
positive.code:             # Atomically replace the symlink
              # See https://axialcorps.com/2013/07/03/atomically-replacing-files-and-directories/
              old=$(readlink -f ${wrapperDir})
              if [ -e ${wrapperDir}-tmp ]; then
                rm --force --recursive ${wrapperDir}-tmp
              fi
              ln --symbolic --force --no-dereference $wrapperDir ${wrapperDir}-tmp
              mv --no-target-directory ${wrapperDir}-tmp ${wrapperDir}
              rm --force --recursive $old
            else
              # For initial setup
              ln --symbolic $wrapperDir ${wrapperDir}
            fi
          '';
  
  
negative.code: 
            # We want to place the tmpdirs for the wrappers to the parent dir.
            wrapperDir=$(mktemp --directory --tmpdir="${parentWrapperDir}" wrappers.XXXXXXXXXX)
            chmod a+rx "$wrapperDir"
  
            ${lib.concatStringsSep "\n" mkWrappedPrograms}
  
  