anchor.diff:    options = {
   
       security.setuidPrograms = mkOption {
  -      default =
  -        [ "passwd" "su" "crontab" "ping" "ping6"
  -          "fusermount" "wodim" "cdrdao" "growisofs"
  -        ];
  +      default = [];
         description = ''
           Only the programs from system path listed here will be made
           setuid root (through a wrapper program).
  
positive.code:     name = "setuid-wrapper";
      buildCommand = ''
        ensureDir $out/bin
        gcc -Wall -O2 -DWRAPPER_DIR=\"${wrapperDir}\" ${./setuid-wrapper.c} -o $out/bin/setuid-wrapper
        strip -s $out/bin/setuid-wrapper
      '';
    };
  
negative.code:   ###### implementation
  
    config = {
  
      security.setuidPrograms =
        [ "passwd" "su" "crontab" "ping" "ping6"
          "fusermount" "wodim" "cdrdao" "growisofs"
        ];
  
      system.activationScripts.setuid =
        let
          setuidPrograms =
  