anchor.diff:    ###### implementation
   
     config = mkIf config.services.pcscd.enable {
  +
  +    environment.systemPackages = [
  +      pkgs.pcsc-lite
  +    ];
  +
  +    security.polkit.enable = true;
  +
  +    security.polkit.extraConfig = ''
  +      polkit.addRule(function(action, subject) {
  +        if (action.id != "org.debian.pcsc-lite.access_card" ||
  +            action.id != "org.debian.pcsc-lite.access_pcsc") {
  +          return;
  +        }
  +    '' + flip concatMapStrings config.services.pcscd.allowedUsers (n: ''
  +        if (subject.user == "${n}") {
  +          return polkit.Result.YES;
  +        }
  +    '') + flip concatMapStrings config.services.pcscd.allowedGroups (n: ''
  +        for each (var group in subject.groups) {
  +          if (group == "${n}") {
  +            return polkit.Result.YES;
  +          }
  +        }
  +    '') + ''
  +      });
  +    '';
   
       systemd.sockets.pcscd = {
         description = "PCSC-Lite Socket";
  
positive.code: 
  let
    cfgFile = pkgs.writeText "reader.conf" "";
  in
  
  with lib;
  
negative.code:     systemd.services.pcscd = {
        description = "PCSC-Lite daemon";
        preStart = ''
          mkdir -p /var/lib/pcsc
          rm -Rf /var/lib/pcsc/drivers
          ln -s ${pkgs.ccid}/pcsc/drivers /var/lib/pcsc/
        '';
        serviceConfig = {
          Type = "forking";
  