anchor.diff:    mkSetcapProgram =
       { program
       , capabilities
  -    , source ? null
  +    , source
       , owner  ? "nobody"
       , group  ? "nogroup"
       , ...
  
positive.code:     assert (lib.versionAtLeast (lib.getVersion config.boot.kernelPackages.kernel) "4.3");
      ''
        cp ${securityWrapper}/bin/security-wrapper $wrapperDir/${program}
        echo -n "$source" > $wrapperDir/${program}.real
  
        # Prevent races
        chmod 0000 $wrapperDir/${program}
  
negative.code:     }:
      ''
        cp ${securityWrapper}/bin/security-wrapper $wrapperDir/${program}
        echo -n "${source}" > $wrapperDir/${program}.real
  
        # Prevent races
        chmod 0000 $wrapperDir/${program}
  