anchor.diff:  f_limitsconf
   f_adduser
   f_rootaccess
  -f_packages
  +f_package_remove
  +f_package_install
   f_usbguard
   f_postfix
   f_apport
  
positive.code: Remove `suid` bits from `/bin/fusermount` `/bin/mount` `/bin/ping` `/bin/ping6`
  `/bin/su` `/bin/umount` `/usr/bin/bsd-write` `/usr/bin/chage` `/usr/bin/chfn`
  `/usr/bin/chsh` `/usr/bin/mlocate` `/usr/bin/mtr` `/usr/bin/newgrp`
  `/usr/bin/pkexec` `/usr/bin/traceroute6.iputils` `/usr/bin/wall` `/usr/sbin/pppd`.
  
  ==== 28_umask
  CCE-80202-5, UBTU-16-010060
  
negative.code: CCE-80205-8, UBTU-16-010150, UBTU-16-010170, UBTU-16-010190, UBTU-16-010210,
  UBTU-16-010220, UBTU-16-010640
  
  Modify `/etc/login.defs`, e.g. `UMASK`, password age limits and
  `SHA_CRYPT_MAX_ROUNDS`.
  
  ==== 13_sysctl
  Update `$SYSCTL` with `$SYSCTL_CONF`.
  