anchor.diff:  
         chmod "u${if setuid then "+" else "-"}s,g${if setgid then "+" else "-"}s,${permissions}" $wrapperDir/${program}
       '';
  +
  +  mkWrappedPrograms =
  +    builtins.map
  +      (s: if (s ? "capabilities")
  +          then mkSetcapProgram s
  +          else if 
  +             (s ? "setuid"  && s.setuid  == true) ||
  +             (s ? "setguid" && s.setguid == true) ||
  +             (s ? "permissions")
  +          then mkSetuidProgram s
  +          else ""
  +      ) programs;
   in
   {
   
  
positive.code: { config, lib, pkgs, ... }:
  let
  
    inherit (config.security) wrapperDir;
  
    wrappers  = config.security.wrappers;
    mkWrapper = { program, source ? null, ...}: ''
      if ! source=${if source != null then source else "$(readlink -f $(PATH=$WRAPPER_PATH type -tP ${program}))"}; then
          # If we can't find the program, fall back to the
  
negative.code:     unpackPhase  = "true";
      installPhase = ''
        mkdir -p $out/bin
        ${lib.concatMapStrings (builtins.map mkWrapper programs)}
      '';
    };
  
  