anchor.diff:  
     options = {
       security.wrappers = lib.mkOption {
  -      type = lib.types.attrs;
  +      type = lib.types.attrsOf wrapperType;
         default = {};
         example = lib.literalExample
           ''
  
positive.code:   mkSetuidProgram =
      { program
      , source
      , owner  ? "nobody"
      , group  ? "nogroup"
      , setuid ? false
      , setgid ? false
      , permissions ? "u+rx,g+x,o+x"
      , ...
      }:
      ''
  
negative.code:   inherit (config.security) wrapperDir wrappers;
  
    parentWrapperDir = dirOf wrapperDir;
  
    securityWrapper = pkgs.callPackage ./wrapper.nix {
      inherit parentWrapperDir;
    };
  
    fileModeType =
      let
        # taken from the chmod(1) man page
        symbolic = "[ugoa]*([-+=]([rwxXst]*|[ugo]))+|[-+=][0-7]+";
        numeric = "[-+=]?[0-7]{0,4}";
        mode = "((${symbolic})(,${symbolic})*)|(${numeric})";
      in
       lib.types.strMatching mode
       // { description = "file mode string"; };
  
    wrapperType = lib.types.submodule ({ name, config, ... }: {
      options.source = lib.mkOption
        { type = lib.types.path;
          description = "The absolute path to the program to be wrapped.";
        };
      options.program = lib.mkOption
        { type = with lib.types; nullOr str;
          default = name;
          description = ''
            The name of the wrapper program. Defaults to the attribute name.
          '';
        };
      options.owner = lib.mkOption
        { type = lib.types.str;
          default = with config;
            if (capabilities != "") || !(setuid || setgid || permissions != null)
            then "root"
            else "nobody";
          description = ''
            The owner of the wrapper program. Defaults to <literal>root</literal>
            if any capability is set and setuid/setgid/permissions are not, otherwise to
            <literal>nobody</litera>.
          '';
        };
      options.group = lib.mkOption
        { type = lib.types.str;
          default = with config;
            if (capabilities != "") || !(setuid || setgid || permissions != null)
            then "root"
            else "nogroup";
          description = ''
            The group of the wrapper program. Defaults to <literal>root</literal>
            if any capability is set and setuid/setgid/permissions are not,
            otherwise to <literal>nogroup</litera>.
          '';
        };
      options.permissions = lib.mkOption
        { type = lib.types.nullOr fileModeType;
          default = null;
          example = "u+rx,g+x,o+x";
          apply = x: if x == null then "u+rx,g+x,o+x" else x;
          description = ''
            The permissions of the wrapper program. The format is that of a
            symbolic or numeric file mode understood by <command>chmod</command>.
          '';
        };
      options.capabilities = lib.mkOption
        { type = lib.types.commas;
          default = "";
          description = ''
            A comma-separated list of capabilities to be given to the wrapper
            program. For capabilities supported by the system check the
            <citerefentry>
              <refentrytitle>capabilities</refentrytitle>
              <manvolnum>7</manvolnum>
            </citerefentry>
            manual page.
  
            <note><para>
              <literal>cap_setpcap</literal>, which is required for the wrapper
              program to be able to raise caps into the Ambient set is NOT raised
              to the Ambient set so that the real program cannot modify its own
              capabilities!! This may be too restrictive for cases in which the
              real program needs cap_setpcap but it at least leans on the side
              security paranoid vs. too relaxed.
            </para></note>
          '';
        };
      options.setuid = lib.mkOption
        { type = lib.types.bool;
          default = false;
          description = "Whether to add the setuid bit the wrapper program.";
        };
      options.setgid = lib.mkOption
        { type = lib.types.bool;
          default = false;
          description = "Whether to add the setgid bit the wrapper program.";
        };
    });
  
    ###### Activation script for the setcap wrappers
    mkSetcapProgram =
      { program
      , capabilities
      , source
      , owner
      , group
      , permissions
      , ...
      }:
      assert (lib.versionAtLeast (lib.getVersion config.boot.kernelPackages.kernel) "4.3");
  