anchor.diff:  # Dangerous features that can be permanently (for the boot session) disabled at
   # boot via sysctl or kernel cmdline are left enabled here, for improved
   # flexibility.
  +#
  +# See also <nixos/modules/profiles/hardened.nix>
   
   { stdenv, version }:
   
  
positive.code:   RANDOMIZE_BASE y
    RANDOMIZE_MEMORY y
  
    # Modern libc no longer needs a fixed-position mapping in userspace, remove it as a possible target.
    LEGACY_VSYSCALL_NONE y
  ''}
  
  # Make sure kernel page tables have safe permissions.
  DEBUG_KERNEL y
  
  ${optionalString (versionOlder version "4.11") ''
    DEBUG_RODATA y
    DEBUG_SET_MODULE_RONX y
  ''}
  
  ${optionalString (versionAtLeast version "4.11") ''
    GCC_PLUGIN_STRUCTLEAK y # A port of the PaX structleak plugin
  ''}
  
  # Report any dangerous memory permissions (not available on all archs).
  DEBUG_WX y
  
  # Do not allow direct physical memory access (but if you must have it, at least enable STRICT mode...)
  # DEVMEM is not set
  STRICT_DEVMEM y
  IO_STRICT_DEVMEM y
  
  # Perform additional validation of various commonly targeted structures.
  DEBUG_CREDENTIALS y
  DEBUG_NOTIFIERS y
  DEBUG_LIST y
  DEBUG_SG y
  BUG_ON_DATA_CORRUPTION y
  SCHED_STACK_END_CHECK y
  
  # Provide userspace with seccomp BPF API for syscall attack surface reduction.
  SECCOMP y
  SECCOMP_FILTER y
  
  # Provide userspace with ptrace ancestry protections.
  SECURITY y
  SECURITY_YAMA y
  
  # Perform usercopy bounds checking.
  HARDENED_USERCOPY y
  
negative.code:   # Reduce attack surface by disabling various emulations
    IA32_EMULATION n
    X86_X32 n
    MODIFY_LDT_SYSCALL? n
  
    VMAP_STACK y # Catch kernel stack overflows
  
  