anchor.diff:  
         chmod "u${if setuid then "+" else "-"}s,g${if setgid then "+" else "-"}s,${permissions}" $wrapperDir/${program}
       '';
  +
  +  mkWrappedPrograms =
  +    builtins.map
  +      (s: if (s ? "capabilities")
  +          then mkSetcapProgram s
  +          else if 
  +             (s ? "setuid"  && s.setuid  == true) ||
  +             (s ? "setguid" && s.setguid == true) ||
  +             (s ? "permissions")
  +          then mkSetuidProgram s
  +          else ""
  +      ) programs;
   in
   {
   
  
positive.code: 
      ###### setcap activation script
      system.activationScripts.wrappers =
        let
          programs =
            (map (x: { program = x; owner = "root"; group = "root"; setuid = true; })
              config.security.setuidPrograms)
              ++ lib.mapAttrsToList
                   (n: v: (if v ? "program" then v else v // {program=n;}))
                   wrappers;
  
          mkWrappedPrograms =
            builtins.map
              (s: if (s ? "capabilities")
                  then mkSetcapProgram s
                  else if 
                     (s ? "setuid"  && s.setuid  == true) ||
                     (s ? "setguid" && s.setguid == true) ||
                     (s ? "permissions")
                  then mkSetuidProgram s
                  else ""
              ) programs;
  
        in lib.stringAfter [ "users" ]
          ''
            # Look in the system path and in the default profile for
            # programs to be wrapped.
  
negative.code: { config, lib, pkgs, ... }:
  let
  
    inherit (config.security) wrapperDir wrappers setuidPrograms;
  
    programs =
      (map (x: { program = x; owner = "root"; group = "root"; setuid = true; })
        setuidPrograms)
        ++ lib.mapAttrsToList
             (n: v: (if v ? "program" then v else v // {program=n;}))
             wrappers;
  
    mkWrapper = { program, source ? null, ...}: ''
      if ! source=${if source != null then source else "$(readlink -f $(PATH=$WRAPPER_PATH type -tP ${program}))"}; then
          # If we can't find the program, fall back to the
  