anchor.diff:          }
           { assertion = (cfg.testing -> !cfg.vserver);
             message   = "The vserver patches are only supported in the stable kernel.";
  +        }
  +        { assertion = (cfg.config.restrictProc -> !cfg.config.restrictProcWithGroup) ||
  +                      (cfg.config.restrictProcWithGroup -> !cfg.config.restrictProc);
  +          message   = "You cannot enable both restrictProc and restrictProcWithGroup";
           }
           { assertion = config.boot.kernelPackages.kernel.features ? grsecurity
                      && config.boot.kernelPackages.kernel.features.grsecurity;
  
positive.code:           '';
          };
  
          unrestrictProcGid = mkOption {
            type = types.int;
            default = config.ids.gids.grsecurity;
            description = ''
              If set, specifies a GID which is exempt from
              <literal>/proc</literal> restrictions (set by
              <literal>GRKERN_PROC_USER</literal>). By default, this is
              set to the GID for <literal>grsecurity</literal>, a
              predefined NixOS group, which the <literal>root</literal>
              account is a member of. You may conveniently add other
              users to this group if you need access to
              <literal>/proc</literal>
            '';
          };
  
  
negative.code:       GRKERNSEC y
        ${grsecMainConfig}
  
        ${if cfg.config.restrictProc then
            "GRKERNSEC_PROC_USER y"
          else
            optionalString cfg.config.restrictProcWithGroup ''
              GRKERNSEC_PROC_USERGROUP y
              GRKERNSEC_PROC_GID ${toString cfg.config.unrestrictProcGid}
            ''
        }
  
        GRKERNSEC_SYSCTL ${boolToKernOpt cfg.config.sysctl}
        GRKERNSEC_CHROOT_CHMOD ${boolToKernOpt cfg.config.denyChrootChmod}
  