anchor.diff:  
             ${adjustSetuidOwner}
           '' [ "defaultPath" "users" ];
  -    };
  +
     };
  +  
   }
  
positive.code: with pkgs.lib;
  
  let
  
    options = {
      security = {
        setuidPrograms = mkOption {
          default = [
            "passwd" "su" "crontab" "ping" "ping6"
            "fusermount" "wodim" "cdrdao" "growisofs"
          ];
          description = ''
            Only the programs from system path listed her will be made setuid root
            (through a wrapper program).  It's better to set
            <option>security.extraSetuidPrograms</option>.
          '';
        };
  
        # !!! obsolete
        extraSetuidPrograms = mkOption {
          default = [];
          example = ["fusermount"];
          description = ''
            This option lists additional programs that must be made setuid
            root.
          '';
        };
  
        setuidOwners = mkOption {
          default = [];
          example = [{
            program = "sendmail";
            owner = "nobody";
            group = "postdrop";
            setuid = false;
            setgid = true;
          }];
          description = ''
            This option allows the ownership and permissions on the setuid
            wrappers for specific programs to be overriden from the
            default (setuid root, but not setgid root).
          '';
        };
  
        wrapperDir = mkOption {
          default = "/var/setuid-wrappers";
          description = ''
            This option defines the path to the setuid wrappers.  It
            should generally not be overriden.
          '';
        };
      };
    };
  
    setuidWrapper = pkgs.stdenv.mkDerivation {
      name = "setuid-wrapper";
  
negative.code: in
  
  {
  
    ###### interface
  
    options = {
  
      security.setuidPrograms = mkOption {
        default =
          [ "passwd" "su" "crontab" "ping" "ping6"
            "fusermount" "wodim" "cdrdao" "growisofs"
          ];
        description = ''
          Only the programs from system path listed here will be made
          setuid root (through a wrapper program).
        '';
      };
  
      # !!! obsolete
      security.extraSetuidPrograms = mkOption {
        default = [];
        example = ["fusermount"];
        description = ''
          This option lists additional programs that must be made setuid
          root.
        '';
      };
  
      security.setuidOwners = mkOption {
        default = [];
        example =
          [ { program = "sendmail";
              owner = "nobody";
              group = "postdrop";
              setuid = false;
              setgid = true;
            }
          ];
        description = ''
          This option allows the ownership and permissions on the setuid
          wrappers for specific programs to be overriden from the
          default (setuid root, but not setgid root).
        '';
      };
  
      security.wrapperDir = mkOption {
        default = "/var/setuid-wrappers";
        description = ''
          This option defines the path to the setuid wrappers.  It
          should generally not be overriden.
        '';
      };
  
    };
  
  
    ###### implementation
  
    config = {
    
      system.activationScripts.setuid =
        let
          setuidPrograms = builtins.toString (
            config.security.setuidPrograms ++
            config.security.extraSetuidPrograms ++
            map (x: x.program) config.security.setuidOwners
          );
  
          adjustSetuidOwner = concatStrings (map
            (_entry: let entry = {
              owner = "nobody";
              group = "nogroup";
              setuid = false;
              setgid = false;
            } //_entry; in
            ''
              chown ${entry.owner}.${entry.group} $wrapperDir/${entry.program}
              chmod u${if entry.setuid then "+" else "-"}s $wrapperDir/${entry.program} 
              chmod g${if entry.setgid then "+" else "-"}s $wrapperDir/${entry.program}
            '')
            config.security.setuidOwners);
  
        in pkgs.stringsWithDeps.fullDepEntry
          ''
            # Look in the system path and in the default profile for
            # programs to be wrapped.  However, having setuid programs
            # in a profile is problematic, since the NixOS activation
  