anchor.diff:  
   let
     cfg = config.security.pam.mount;
  +
  +  oflRequired = cfg.logoutHup || cfg.logoutTerm || cfg.logoutKill;
  +
  +  fake_ofl = pkgs.writeShellScriptBin "fake_ofl" ''
  +    SIGNAL=$1
  +    MNTPT=$2
  +    ${pkgs.lsof}/bin/lsof | ${pkgs.gnugrep}/bin/grep $MNTPT | ${pkgs.gawk}/bin/awk '{print $2}' | ${pkgs.findutils}/bin/xargs ${pkgs.util-linux}/bin/kill -$SIGNAL
  +  '';
   
     anyPamMount = any (attrByPath ["pamMount"] false) (attrValues config.security.pam.services);
   in
  
positive.code:           You can define volume-specific options in the volume definitions.
          '';
        };
      };
  
    };
  
negative.code:           <!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
            <!-- auto generated from Nixos: modules/config/users-groups.nix -->
            <pam_mount>
            <debug enable="${toString cfg.debugLevel}" />
            <!-- if activated, requires ofl from hxtools to be present -->
            <logout wait="${toString cfg.logoutWait}" hup="${if cfg.logoutHup then "yes" else "no"}" term="${if cfg.logoutTerm then "yes" else "no"}" kill="${if cfg.logoutKill then "yes" else "no"}" />
            <!-- set PATH variable for pam_mount module -->
            <path>${makeBinPath ([ pkgs.util-linux ] ++ cfg.additionalSearchPaths)}</path>
            <!-- create mount point if not present -->
            <mkmountpoint enable="${if cfg.createMountPoints then "1" else "0"}" remove="${if cfg.removeCreatedMountPoints then "true" else "false"}" />
            <!-- specify the binaries to be called -->
            <fusemount>${pkgs.fuse}/bin/mount.fuse %(VOLUME) %(MNTPT) -o ${concatStringsSep "," (cfg.fuseMountOptions ++ [ "%(OPTIONS)" ])}</fusemount>
            <fuseumount>${pkgs.fuse}/bin/fusermount -u %(MNTPT)</fuseumount>
            <cryptmount>${pkgs.pam_mount}/bin/mount.crypt %(VOLUME) %(MNTPT)</cryptmount>
            <cryptumount>${pkgs.pam_mount}/bin/umount.crypt %(MNTPT)</cryptumount>
            <pmvarrun>${pkgs.pam_mount}/bin/pmvarrun -u %(USER) -o %(OPERATION)</pmvarrun>
            ${optionalString oflRequired "<ofl>${fake_ofl}/bin/fake_ofl %(SIGNAL) %(MNTPT)</ofl>"}
            ${concatStrings (map userVolumeEntry (attrValues extraUserVolumes))}
            ${concatStringsSep "\n" cfg.extraVolumes}
            </pam_mount>
  