anchor.diff:  SystemCallFilter=<%= Array(@system_call_filter).join(" ") %>
   <% end -%>
   <% if @system_call_architectures -%>
  -SystemCallArchitectures=<%= Array(@system_call_architectures).join(" ") %>
  +SystemCallArchitectures=<%= Array(@system_call_architectures).sort.uniq.join(" ") %>
   <% end -%>
   <% if @tasks_max -%>
   TasksMax=<%= @tasks_max %>
  
positive.code: NoNewPrivileges=<%= @no_new_privileges %>
  <% end -%>
  <% if @capability_bounding_set -%>
  CapabilityBoundingSet=<%= Array(@capability_bounding_set).join(" ") %>
  <% end -%>
  <% if @protect_system -%>
  ProtectSystem=<%= @protect_system %>
  
negative.code: ProtectHome=<%= @protect_home %>
  <% end -%>
  <% if @read_write_paths -%>
  ReadWritePaths=<%= Array(@read_write_paths).sort.uniq.join(" ") %>
  <% end -%>
  <% if @read_only_paths -%>
  ReadOnlyPaths=<%= Array(@read_only_paths).sort.uniq.join(" ") %>
  <% end -%>
  <% if @inaccessible_paths -%>
  InaccessiblePaths=<%= Array(@inaccessible_paths).sort.uniq.join(" ") %>
  <% end -%>
  <% if @private_tmp -%>
  PrivateTmp=<%= @private_tmp %>
  