anchor.diff:              DevicePolicy            = "closed";
               InaccessibleDirectories = "/home";
               ReadOnlyDirectories     = "/";
  -            ReadWriteDirectories    = torDirectory;
  +            ReadWriteDirectories    = [torDirectory torRunDirectory];
               NoNewPrivileges         = "yes";
             };
         };
  
positive.code: let
    cfg = config.services.tor;
    torDirectory = "/var/lib/tor";
  
    opt    = name: value: optionalString (value != null) "${name} ${value}";
    optint = name: value: optionalString (value != null && value != 0)    "${name} ${toString value}";
  
negative.code:         '';
        };
  
        controlSocket = {
          enable = mkOption {
            type = types.bool;
            default = false;
            description = ''
              Wheter to enable Tor control socket. Control socket is created
              in <literal>${torRunDirectory}/control</literal>
            '';
          };
        };
  
        client = {
          enable = mkOption {
            type = types.bool;
  