anchor.diff:  
     cfg = config.security.polkit;
   
  -  pkWrapper = pkgs.stdenv.mkDerivation {
  -    name = "polkit-wrapper";
  -    helper = "libexec/polkit-1/polkit-agent-helper-1";
  -    buildInputs = [ pkgs.xorg.lndir ];
  -
  -    builder = pkgs.writeScript "pkwrap-builder" ''
  -      source $stdenv/setup
  -
  -      mkdir -pv $out
  -      lndir ${pkgs.polkit} $out
  -
  -      # !!! I'm pretty sure the wrapper doesn't work because
  -      # libpolkit-agent-1.so has a hard-coded reference to
  -      # polkit-agent-helper-1.
  -      rm $out/$helper
  -      ln -sv ${config.security.wrapperDir}/polkit-agent-helper-1 $out/$helper
  -      '';
  -  };
  -  
   in
   
   {
  
positive.code:         owner = "root";
          group = "root";
          setuid = true;
          source = pkgs.polkit + "/" + pkWrapper.helper;
        };
  
      system.activationScripts.polkit =
  
negative.code: 
    config = mkIf cfg.enable {
  
      environment.systemPackages = [ pkgs.polkit ];
  
      # The polkit daemon reads action files 
      environment.pathsToLink = [ "/share/polkit-1/actions" ];
  