anchor.diff:        SECURITY_YAMA                    = option yes;
         DEVKMEM                          = when (!grsecurity) no; # Disable /dev/kmem
   
  -      USER_NS                          = whenAtLeast "3.12" yes; # Support for user namespaces
  +      USER_NS                          = yes; # Support for user namespaces
   
         SECURITY_APPARMOR                = yes;
         DEFAULT_SECURITY_APPARMOR        = yes;
   
  -      AUDIT_LOGINUID_IMMUTABLE = whenBetween "3.3" "3.13" yes;
       } // optionalAttrs (!stdenv.hostPlatform.isAarch32) {
   
         # Detect buffer overflows on the stack
  -      CC_STACKPROTECTOR         = option (whenOlder "3.14" yes);
         CC_STACKPROTECTOR_REGULAR = option (whenOlder "4.18" yes);
       };
   
  
positive.code:       # XXX: why isn't this in the xen-dom0 conditional section below?
        XEN_DOM0 = option yes;
  
      } // optionalAttrs (versionAtLeast version "3.18" && xen_dom0) {
        PCI_XEN                     = option yes;
        HVC_XEN                     = option yes;
        HVC_XEN_FRONTEND            = option yes;
  
negative.code:     };
  
      usb = {
        USB_DEBUG            = option no;
        USB_EHCI_ROOT_HUB_TT = yes; # Root Hub Transaction Translators
        USB_EHCI_TT_NEWSCHED = yes; # Improved transaction translator scheduling
      };
  