anchor.diff:          RestrictSUIDSGID = true;
           UMask = "0066";
           ProtectProc = "invisible";
  -        ProcSubset = "pid";
           SystemCallFilter = [
  -          "~@debug"
  +          "~@capset"
  +          "~@clock"
  +          "~@cpu-emulation"
  +          "~@module"
             "~@mount"
  -          "~@privileged"
  -          "~@cpu-emulation"
             "~@obsolete"
  +          "~@raw-io"
  +          "~@reboot"
  +          "~setdomainname"
  +          "~sethostname"
           ];
           RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" "AF_NETLINK" ];
   
  
positive.code:         CapabilityBoundingSet = "";
          # ProtectClock= adds DeviceAllow=char-rtc r
          DeviceAllow = "";
          LockPersonality = true;
          NoNewPrivileges = true;
          PrivateDevices = true;
          PrivateMounts = true;
  
negative.code:         PrivateNetwork = false;
          # Cannot be true due to Node
          MemoryDenyWriteExecute = false;
  
          # The more restrictive "pid" option makes `nix` commands in CI emit
          # "GC Warning: Couldn't read /proc/stat"
          # You may want to set this to "pid" if not using `nix` commands
          ProcSubset = "all";
          # Coverage programs for compiled code such as `cargo-tarpaulin` disable
          # ASLR (address space layout randomization) which requires the
          # `personality` syscall
          # You may want to set this to `true` if not using coverage tooling on
          # compiled code
          LockPersonality = false;
        };
      };
    };
  