anchor.diff:  # * **64**  - signalling of processes (term, kill, oom-kill)
   # * **128** - reboot/poweroff
   # * **256** - nicing of all RT tasks
  -kernel.sysrq = <%= ((@node['security']['kernel']['enable_sysrq']) ? "#{@node['security']['kernel']['secure_sysrq']}" : "0" ) %>
  +kernel.sysrq = <%= ((@node['security']['kernel']['enable_sysrq']) || 0) %>
   
   # Prevent core dumps with SUID. These are usually only needed by developers and
   # may contain sensitive information.
  -fs.suid_dumpable = <%= ((@node['security']['kernel']['enable_core_dump']) ? "1" : "0") %>
  +fs.suid_dumpable = <%= ((@node['security']['kernel']['enable_core_dump']) ? 1 : 0) %>
  
positive.code: net.ipv4.icmp_ratemask = 88089
  
  # Disable or Enable IPv6 as it is needed.
  net.ipv6.conf.all.disable_ipv6 = <%= ((@node['network']['ipv6']['enable']) ? "0" : "1") %>
  
  # Protect against wrapping sequence numbers at gigabit speeds:
  net.ipv4.tcp_timestamps = 0
  
negative.code: #           other interfaces, with the hope we will receive reply for our
  #           request and even sometimes no matter the source IP address we
  #           announce.
  net.ipv4.conf.eth0.arp_ignore = <%= ((@node['network']['arp']['restricted']) ? 1 : 0) %>
  
  
  # Define different modes for sending replies in response to received ARP requests that resolve local target IP addresses:
  