anchor.diff:    INTEL_TXT y
     SECURITY_YAMA y
     DEFAULT_SECURITY_DAC y
  +  SECURITY_DMESG_RESTRICT y
   
     # Microcode loading support
     MICROCODE y
  
positive.code:   MICROCODE_AMD y
  
    # Misc. options.
    EXPERT y
    STRIP_ASM_SYMS y
    UNUSED_SYMBOLS y
  
negative.code:   # Security related features.
    RANDOMIZE_BASE y
    STRICT_DEVMEM y # Filter access to /dev/mem
    IO_STRICT_DEVMEM y
    SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
    DEVKMEM n # Disable /dev/kmem
    CC_STACKPROTECTOR_REGULAR y
  