anchor.diff:  
           # Translated from the upstream contrib/dist/tor.service.in
           preStart = ''
  -          install -o tor -g tor -d ${torDirectory}/onion
  +          install -o tor -g tor -d ${torDirectory}/onion ${torRunDirectory}
             ${pkgs.tor}/bin/tor -f ${torRcFile} --verify-config
           '';
   
  
positive.code:             DevicePolicy            = "closed";
              InaccessibleDirectories = "/home";
              ReadOnlyDirectories     = "/";
              ReadWriteDirectories    = torDirectory;
              NoNewPrivileges         = "yes";
            };
        };
  
negative.code:     ''}
  
      ${optint "ControlPort" cfg.controlPort}
      ${optionalString cfg.controlSocket.enable "ControlSocket ${torRunDirectory}/control GroupWritable RelaxDirModeCheck"}
    ''
    # Client connection config
    + optionalString cfg.client.enable ''
  