anchor.diff:        DEBUG_SET_MODULE_RONX            = { optional = true; tristate = whenOlder "4.11" "y"; };
         RANDOMIZE_BASE                   = option yes;
         STRICT_DEVMEM                    = option yes; # Filter access to /dev/mem
  -      SECURITY_SELINUX_BOOTPARAM_VALUE = option (freeform "0"); # Disable SELinux by default
  +      SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default
         # Prevent processes from ptracing non-children processes
         SECURITY_YAMA                    = option yes;
         DEVKMEM                          = mkIf (!features.grsecurity) no; # Disable /dev/kmem
  
positive.code:       PM_WAKELOCKS                     = yes;
        # Power-capping framework and support for INTEL RAPL
        POWERCAP                         = yes;
        INTEL_RAPL                       = module;
      };
  
      external-firmware = {
  
negative.code:       CIFS_STATS        = whenOlder "4.19" yes;
        CIFS_WEAK_PW_HASH = yes;
        CIFS_UPCALL       = yes;
        CIFS_ACL          = whenOlder "5.3" yes;
        CIFS_DFS_UPCALL   = yes;
        CIFS_SMB2         = whenOlder "4.13" yes;
  
  