anchor.diff:  # Randomize allocator freelists.
   SLAB_FREELIST_RANDOM y
   
  -# Wipe higher-level memory allocations when they are freed (needs "page_poison 1" command line below).
  -# (If you can afford even more performance penalty, leave PAGE_POISONING_NO_SANITY n)
  +# Wipe higher-level memory allocations on free() with page_poison=1
   PAGE_POISONING y
   PAGE_POISONING_NO_SANITY y
   PAGE_POISONING_ZERO y
  
positive.code: # Dangerous features that can be permanently (for the boot session) disabled at
  # boot via sysctl or kernel cmdline are left enabled here, for improved
  # flexibility.
  
  { stdenv, version }:
  
  
negative.code: PANIC_ON_OOPS y
  PANIC_TIMEOUT -1
  
  GCC_PLUGINS y # Enable gcc plugin options
  
  ${optionalString (versionAtLeast version "4.11") ''
    GCC_PLUGIN_STRUCTLEAK y # A port of the PaX structleak plugin
  ''}
  
  # Disable various dangerous settings
  ACPI_CUSTOM_METHOD n # Allows writing directly to physical memory
  