anchor.diff:    # Reduce attack surface by disabling various emulations
     IA32_EMULATION n
     X86_X32 n
  -  MODIFY_LDT_SYSCALL n
  +  MODIFY_LDT_SYSCALL? n
   
     VMAP_STACK y # Catch kernel stack overflows
   
  
positive.code: # Dangerous features that can be permanently (for the boot session) disabled at
  # boot via sysctl or kernel cmdline are left enabled here, for improved
  # flexibility.
  
  { stdenv, version }:
  
  
negative.code: PANIC_ON_OOPS y
  PANIC_TIMEOUT -1
  
  GCC_PLUGINS y # Enable gcc plugin options
  
  ${optionalString (versionAtLeast version "4.11") ''
    GCC_PLUGIN_STRUCTLEAK y # A port of the PaX structleak plugin
  ''}
  
  # Disable various dangerous settings
  ACPI_CUSTOM_METHOD n # Allows writing directly to physical memory
  