anchor.diff:      environment.systemPackages = [ pkgs.polkit.bin pkgs.polkit.out ];
   
       systemd.packages = [ pkgs.polkit.out ];
  +
  +    systemd.services.polkit.serviceConfig.ExecStart = [
  +      ""
  +      "${pkgs.polkit.out}/lib/polkit-1/polkitd ${optionalString (!cfg.debug) "--no-debug"}"
  +    ];
   
       systemd.services.polkit.restartTriggers = [ config.system.path ];
       systemd.services.polkit.stopIfChanged = false;
  
positive.code: 
      security.polkit.enable = mkEnableOption (lib.mdDoc "polkit");
  
      security.polkit.extraConfig = mkOption {
        type = types.lines;
        default = "";
  
negative.code:         ''
            /* Log authorization checks. */
            polkit.addRule(function(action, subject) {
              // Make sure to set { security.polkit.debug = true; } in configuration.nix
              polkit.log("user " +  subject.user + " is attempting action " + action.id + " from PID " + subject.pid);
            });
  
  