anchor.diff:  Remove `suid` bits from `/bin/fusermount` `/bin/mount` `/bin/ping` `/bin/ping6`
   `/bin/su` `/bin/umount` `/usr/bin/bsd-write` `/usr/bin/chage` `/usr/bin/chfn`
   `/usr/bin/chsh` `/usr/bin/mlocate` `/usr/bin/mtr` `/usr/bin/newgrp`
  -`/usr/bin/pkexec` `/usr/bin/traceroute6.iputils` `/usr/bin/wall` `/usr/sbin/pppd`.
  +`/usr/bin/pkexec` `/usr/bin/traceroute6.iputils` `/usr/bin/wall`
  +`/usr/sbin/pppd`.
   
   ==== 28_umask
   CCE-80202-5, UBTU-16-010060
  
positive.code: ----
  
  == Tests
  There are approximately 400 https://github.com/sstephenson/bats[Bats tests] for most of the above settings available in the link:tests/[tests directory].
  
  [source,shell]
  ----
  
negative.code: Disable `dccp` `sctp` `rds` `tipc` protocols.
  
  ==== 04_disablemnt
  CCE-80137-3, CCE-80138-1, CCE-80139-9, CCE-80140-7, CCE-80141-5, CCE-80142-3,
  CCE-80143-1, UBTU-16-010070
  
  Disable `cramfs` `freevxfs` `jffs2` `hfs` `hfsplus` `squashfs` `udf` `vfat` file
  systems.
  
  ==== 05_systemdconf
  Disable coredumps and crash shells, set `DefaultLimitNOFILE` and
  `DefaultLimitNPROC` to 100.
  
  ==== 06_journalctl
  Compress logs, forward to syslog and make log storage persistent.
  