anchor.diff:      name = "setuid-wrapper";
       buildCommand = ''
         ensureDir $out/bin
  -      gcc -Wall -O2 -DWRAPPER_DIR=\"${wrapperDir}\" ${./setuid-wrapper.c} -o $out/bin/setuid-wrapper
  +      gcc -Wall -O2 -DWRAPPER_DIR=\"${wrapperDir}\" \
  +          ${./setuid-wrapper.c} -o $out/bin/setuid-wrapper
         strip -s $out/bin/setuid-wrapper
       '';
     };
  
positive.code:   options = {
  
      security.setuidPrograms = mkOption {
        default =
          [ "passwd" "su" "crontab" "ping" "ping6"
            "fusermount" "wodim" "cdrdao" "growisofs"
          ];
        description = ''
          Only the programs from system path listed here will be made
          setuid root (through a wrapper program).
  
negative.code:   ###### implementation
  
    config = {
  
      security.setuidPrograms =
        [ "passwd" "su" "crontab" "ping" "ping6"
          "fusermount" "wodim" "cdrdao" "growisofs"
        ];
  
      system.activationScripts.setuid =
        let
          setuidPrograms =
  