anchor.diff:  
       system.activationScripts.nova =
         ''
  -        mkdir -m 700 -p /var/lib/nova
  +        mkdir -m 755 -p /var/lib/nova
  +        mkdir -m 755 -p /var/lib/nova/networks
  +        mkdir -m 700 -p /var/lib/nova/instances
  +        mkdir -m 700 -p /var/lib/nova/keys
   
           # Allow the CA certificate generation script (called by
           # nova-api) to work.
  
positive.code:         description = "Nova simple object store service";
  
          startOn = "ip-up";
  
          exec = "${nova}/bin/nova-objectstore --nodaemon";
        };
  
negative.code: 
          startOn = "ip-up";
  
          # `openssl' is required to generate the CA.  `openssh' is
          # required to generate key pairs.
          path = [ pkgs.openssl pkgs.openssh ];
            
          exec = "${nova}/bin/nova-api";
        };
  