anchor.diff:  
     mkWrappedPrograms =
       builtins.map
  -      (s: if (s ? capabilities)
  -          then mkSetcapProgram
  -                 ({ owner = "root";
  -                    group = "root";
  -                  } // s)
  -          else if
  -             (s ? setuid && s.setuid) ||
  -             (s ? setgid && s.setgid) ||
  -             (s ? permissions)
  -          then mkSetuidProgram s
  -          else mkSetuidProgram
  -                 ({ owner  = "root";
  -                    group  = "root";
  -                    setuid = true;
  -                    setgid = false;
  -                    permissions = "u+rx,g+x,o+x";
  -                  } // s)
  -      ) programs;
  +      (opts:
  +        if opts.capabilities != ""
  +          then mkSetcapProgram opts
  +          else mkSetuidProgram opts
  +      ) (lib.attrValues wrappers);
   in
   {
     imports = [
  
positive.code: 
    options = {
      security.wrappers = lib.mkOption {
        type = lib.types.attrs;
        default = {};
        example = lib.literalExample
          ''
  
negative.code:   mkSetuidProgram =
      { program
      , source
      , owner
      , group
      , setuid
      , setgid
      , permissions
      , ...
      }:
      ''
  