anchor.diff:        GRKERNSEC y
         ${grsecMainConfig}
   
  -      GRKERNSEC_PROC_USER ${boolToKernOpt cfg.config.restrictProc}
  -      ${if !cfg.config.restrictProc then ""
  -        else "GRKERNSEC_PROC_GID "+(toString cfg.config.unrestrictProcGid)}
  +      ${if cfg.config.restrictProc then
  +          "GRKERNSEC_PROC_USER y"
  +        else
  +          optionalString cfg.config.restrictProcWithGroup ''
  +            GRKERNSEC_PROC_USERGROUP y
  +            GRKERNSEC_PROC_GID ${toString cfg.config.unrestrictProcGid}
  +          ''
  +      }
   
         GRKERNSEC_SYSCTL ${boolToKernOpt cfg.config.sysctl}
         GRKERNSEC_CHROOT_CHMOD ${boolToKernOpt cfg.config.denyChrootChmod}
  
positive.code: 
          restrictProc = mkOption {
            type = types.bool;
            default = true;
            description = ''
              If true, then set <literal>GRKERN_PROC_USER
              y</literal>. This restricts non-root users to only viewing
  
negative.code:         }
          { assertion = (cfg.testing -> !cfg.vserver);
            message   = "The vserver patches are only supported in the stable kernel.";
          }
          { assertion = (cfg.config.restrictProc -> !cfg.config.restrictProcWithGroup) ||
                        (cfg.config.restrictProcWithGroup -> !cfg.config.restrictProc);
            message   = "You cannot enable both restrictProc and restrictProcWithGroup";
          }
          { assertion = config.boot.kernelPackages.kernel.features ? grsecurity
                     && config.boot.kernelPackages.kernel.features.grsecurity;
  