anchor.diff:          CapabilityBoundingSet = "";
           # ProtectClock= adds DeviceAllow=char-rtc r
           DeviceAllow = "";
  -        LockPersonality = true;
           NoNewPrivileges = true;
           PrivateDevices = true;
           PrivateMounts = true;
  
positive.code:         RestrictSUIDSGID = true;
          UMask = "0066";
          ProtectProc = "invisible";
          ProcSubset = "pid";
          SystemCallFilter = [
            "~@debug"
            "~@mount"
            "~@privileged"
            "~@cpu-emulation"
            "~@obsolete"
          ];
          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" "AF_NETLINK" ];
  
  
negative.code:         PrivateNetwork = false;
          # Cannot be true due to Node
          MemoryDenyWriteExecute = false;
  
          # The more restrictive "pid" option makes `nix` commands in CI emit
          # "GC Warning: Couldn't read /proc/stat"
          # You may want to set this to "pid" if not using `nix` commands
          ProcSubset = "all";
          # Coverage programs for compiled code such as `cargo-tarpaulin` disable
          # ASLR (address space layout randomization) which requires the
          # `personality` syscall
          # You may want to set this to `true` if not using coverage tooling on
          # compiled code
          LockPersonality = false;
        };
      };
    };
  