anchor.diff:    # Security related features.
     STRICT_DEVMEM y # Filter access to /dev/mem
     SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
  -  DEVKMEM n # Disable /dev/kmem
  +  DEVKMEM? n # Disable /dev/kmem
     ${if versionOlder version "3.14" then ''
       CC_STACKPROTECTOR y # Detect buffer overflows on the stack
     '' else ''
  
positive.code:   ''}
  
    # Enable the 9P cache to speed up NixOS VM tests.
    9P_FSCACHE y
    9P_FS_POSIX_ACL y
  
    ${kernelPlatform.kernelExtraConfig or ""}
    ${extraConfig}
  
negative.code:   ${optionalString (versionAtLeast version "3.3" && versionOlder version "3.13") ''
      AUDIT_LOGINUID_IMMUTABLE y
    ''}
    B43_PCMCIA? y
    BLK_DEV_CMD640_ENHANCED y # CMD640 enhanced support
    BLK_DEV_IDEACPI y # IDE ACPI support
    BLK_DEV_INTEGRITY y
    BSD_PROCESS_ACCT_V3 y
    BT_HCIUART_BCSP? y
    BT_HCIUART_H4? y # UART (H4) protocol support
    BT_HCIUART_LL? y
    BT_RFCOMM_TTY? y # RFCOMM TTY support
    CRASH_DUMP? n
    ${optionalString (versionOlder version "3.1") ''
  