anchor.diff:  
     mkWrappedPrograms =
       builtins.map
  -      (s: if (s ? capabilities)
  -          then mkSetcapProgram
  -                 ({ owner = "root";
  -                    group = "root";
  -                  } // s)
  -          else if
  -             (s ? setuid && s.setuid) ||
  -             (s ? setgid && s.setgid) ||
  -             (s ? permissions)
  -          then mkSetuidProgram s
  -          else mkSetuidProgram
  -                 ({ owner  = "root";
  -                    group  = "root";
  -                    setuid = true;
  -                    setgid = false;
  -                    permissions = "u+rx,g+x,o+x";
  -                  } // s)
  -      ) programs;
  +      (opts:
  +        if opts.capabilities != ""
  +          then mkSetcapProgram opts
  +          else mkSetuidProgram opts
  +      ) (lib.attrValues wrappers);
   in
   {
     imports = [
  
positive.code:           }
          '';
        description = ''
          This option allows the ownership and permissions on the setuid
          wrappers for specific programs to be overridden from the
          default (setuid root, but not setgid root).
  
          <note>
            <para>The sub-attribute <literal>source</literal> is mandatory,
            it must be the absolute path to the program to be wrapped.
            </para>
  
            <para>The sub-attribute <literal>program</literal> is optional and
            can give the wrapper program a new name. The default name is the same
            as the attribute name itself.</para>
  
            <para>Additionally, this option can set capabilities on a
            wrapper program that propagates those capabilities down to the
            wrapped, real program.</para>
  
            <para>NOTE: cap_setpcap, which is required for the wrapper
            program to be able to raise caps into the Ambient set is NOT
            raised to the Ambient set so that the real program cannot
            modify its own capabilities!! This may be too restrictive for
            cases in which the real program needs cap_setpcap but it at
            least leans on the side security paranoid vs. too
            relaxed.</para>
          </note>
        '';
      };
  
  
negative.code:   mkSetuidProgram =
      { program
      , source
      , owner
      , group
      , setuid
      , setgid
      , permissions
      , ...
      }:
      ''
  