anchor.diff:        capabilities = "cap_dac_override+ep";
         owner = cfg.user;
         group = cfg.group;
  -      permissions = "u+rx,g+rx,o-rx";
  +      permissions = "u+rx,g+x,o-rwx";
       };
   
       security.pam.loginLimits = [
  
positive.code:       capabilities = "cap_sys_admin+ep";
        owner = cfg.user;
        group = cfg.group;
        permissions = "u+rx,g+rx,o-rx";
      };
  
      security.wrappers."slabinfo.plugin" = {
  
negative.code:       capabilities = "cap_setuid+ep";
        owner = cfg.user;
        group = cfg.group;
        permissions = "u+rx,g+x,o-rwx";
      };
  
      security.wrappers."freeipmi.plugin" = {
  