anchor.diff:            '';
           };
   
  +        restrictProcWithGroup = mkOption {
  +          type = types.bool;
  +          default = true;
  +          description = ''
  +            If true, then set <literal>GRKERN_PROC_USERGROUP
  +            y</literal>. This is similar to
  +            <literal>restrictProc</literal> except it allows a special
  +            group (specified by <literal>unrestrictProcGid</literal>)
  +            to still access otherwise classified information in
  +            <literal>/proc</literal>.
  +          '';
  +        };
  +
           unrestrictProcGid = mkOption {
             type = types.int;
             default = config.ids.gids.grsecurity;
             description = ''
               If set, specifies a GID which is exempt from
               <literal>/proc</literal> restrictions (set by
  -            <literal>GRKERN_PROC_USER</literal>). By default, this is
  -            set to the GID for <literal>grsecurity</literal>, a
  -            predefined NixOS group, which the <literal>root</literal>
  -            account is a member of. You may conveniently add other
  -            users to this group if you need access to
  -            <literal>/proc</literal>
  +            <literal>GRKERN_PROC_USERGROUP</literal>). By default,
  +            this is set to the GID for <literal>grsecurity</literal>,
  +            a predefined NixOS group, which the
  +            <literal>root</literal> account is a member of. You may
  +            conveniently add other users to this group if you need
  +            access to <literal>/proc</literal>
             '';
           };
   
  
positive.code:         }
          { assertion = (cfg.testing -> !cfg.vserver);
            message   = "The vserver patches are only supported in the stable kernel.";
          }
          { assertion = config.boot.kernelPackages.kernel.features ? grsecurity
                     && config.boot.kernelPackages.kernel.features.grsecurity;
  
negative.code:       GRKERNSEC y
        ${grsecMainConfig}
  
        ${if cfg.config.restrictProc then
            "GRKERNSEC_PROC_USER y"
          else
            optionalString cfg.config.restrictProcWithGroup ''
              GRKERNSEC_PROC_USERGROUP y
              GRKERNSEC_PROC_GID ${toString cfg.config.unrestrictProcGid}
            ''
        }
  
        GRKERNSEC_SYSCTL ${boolToKernOpt cfg.config.sysctl}
        GRKERNSEC_CHROOT_CHMOD ${boolToKernOpt cfg.config.denyChrootChmod}
  