anchor.diff:  { config, lib, pkgs, ... }:
   let
   
  -  inherit (config.security) wrapperDir;
  +  inherit (config.security) wrapperDir wrappers setuidPrograms;
   
  -  wrappers  = config.security.wrappers;
  +  programs =
  +    (map (x: { program = x; owner = "root"; group = "root"; setuid = true; })
  +      setuidPrograms)
  +      ++ lib.mapAttrsToList
  +           (n: v: (if v ? "program" then v else v // {program=n;}))
  +           wrappers;
  +
     mkWrapper = { program, source ? null, ...}: ''
       if ! source=${if source != null then source else "$(readlink -f $(PATH=$WRAPPER_PATH type -tP ${program}))"}; then
           # If we can't find the program, fall back to the
  
positive.code: 
      ###### setcap activation script
      system.activationScripts.wrappers =
        let
          programs =
            (map (x: { program = x; owner = "root"; group = "root"; setuid = true; })
              config.security.setuidPrograms)
              ++ lib.mapAttrsToList
                   (n: v: (if v ? "program" then v else v // {program=n;}))
                   wrappers;
  
          mkWrappedPrograms =
            builtins.map
              (s: if (s ? "capabilities")
                  then mkSetcapProgram s
                  else if 
                     (s ? "setuid"  && s.setuid  == true) ||
                     (s ? "setguid" && s.setguid == true) ||
                     (s ? "permissions")
                  then mkSetuidProgram s
                  else ""
              ) programs;
  
        in lib.stringAfter [ "users" ]
          ''
            # Look in the system path and in the default profile for
            # programs to be wrapped.
  
negative.code: 
        chmod "u${if setuid then "+" else "-"}s,g${if setgid then "+" else "-"}s,${permissions}" $wrapperDir/${program}
      '';
  
    mkWrappedPrograms =
      builtins.map
        (s: if (s ? "capabilities")
            then mkSetcapProgram s
            else if 
               (s ? "setuid"  && s.setuid  == true) ||
               (s ? "setguid" && s.setguid == true) ||
               (s ? "permissions")
            then mkSetuidProgram s
            else ""
        ) programs;
  in
  {
  
  