anchor.diff:  SystemCallFilter=<%= Array(@system_call_filter).join(" ") %>
   <% end -%>
   <% if @system_call_architectures -%>
  -SystemCallArchitectures=<%= Array(@system_call_architectures).join(" ") %>
  +SystemCallArchitectures=<%= Array(@system_call_architectures).sort.uniq.join(" ") %>
   <% end -%>
   <% if @tasks_max -%>
   TasksMax=<%= @tasks_max %>
  
positive.code: ProtectControlGroups=<%= @protect_control_groups %>
  <% end -%>
  <% if @restrict_address_families -%>
  RestrictAddressFamilies=<%= Array(@restrict_address_families).join(" ") %>
  <% end -%>
  <% if @restrict_namespaces -%>
  RestrictNamespaces=<%= Array(@restrict_namespaces).join(" ") %>
  <% end -%>
  <% if @lock_personality -%>
  LockPersonality=<%= @lock_personality %>
  
negative.code: NoNewPrivileges=<%= @no_new_privileges %>
  <% end -%>
  <% if @capability_bounding_set -%>
  CapabilityBoundingSet=<%= Array(@capability_bounding_set).sort.uniq.join(" ") %>
  <% end -%>
  <% if @protect_system -%>
  ProtectSystem=<%= @protect_system %>
  