anchor.diff:            config.environment.etc."nscd.conf".source
           ];
   
  -        # We use DynamicUser because in default configurations nscd doesn't
  -        # create any files that need to survive restarts. However, in some
  -        # configurations, nscd needs to be started as root; it will drop
  -        # privileges after all the NSS modules have read their configuration
  -        # files. So prefix the ExecStart command with "!" to prevent systemd
  -        # from dropping privileges early. See ExecStart in systemd.service(5).
  +        # In some configurations, nscd needs to be started as root; it will
  +        # drop privileges after all the NSS modules have read their
  +        # configuration files. So prefix the ExecStart command with "!" to
  +        # prevent systemd from dropping privileges early. See ExecStart in
  +        # systemd.service(5). We use a static user, because some NSS modules
  +        # sill want to read their configuration files after the privilege drop
  +        # and so users can set the owner of those files to the nscd user.
           serviceConfig =
             { ExecStart = "!@${cfg.package}/bin/nscd nscd";
               Type = "forking";
  -            DynamicUser = true;
  +            User = cfg.user;
  +            Group = cfg.group;
  +            RemoveIPC = true;
  +            PrivateTmp = true;
  +            NoNewPrivileges = true;
  +            RestrictSUIDSGID = true;
  +            ProtectSystem = "strict";
  +            ProtectHome = "read-only";
               RuntimeDirectory = "nscd";
               PIDFile = "/run/nscd/nscd.pid";
               Restart = "always";
  
positive.code:           Whether to enable the Name Service Cache Daemon.
            Disabling this is strongly discouraged, as this effectively disables NSS Lookups
            from all non-glibc NSS modules, including the ones provided by systemd.
          '';
        };
  
  
negative.code:   config = mkIf cfg.enable {
      environment.etc."nscd.conf".text = cfg.config;
  
      users.users.${cfg.user} = {
        isSystemUser = true;
        group = cfg.group;
      };
  
      users.groups.${cfg.group} = {};
  
      systemd.services.nscd =
        { description = "Name Service Cache Daemon";
  
  