alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

nixos/lightdm: fix pam rules

Browse source 
Rules are a translation of what's done in the
GDM module and adjustments based of looking at
Arch Linux's configuration and upstream's.

A side effect of this change is that gnome-keyring
and kwallet modules should work as expected when in-
cluded.

Fixes #64259 #62045
This commit is contained in:
worldofpeace 2019-07-14 06:32:44 -04:00
parent 5d4890b58d
commit 0c602541a3
1 changed files with 28 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

51
nixos/modules/services/x11/display-managers/lightdm.nix
View file

@ -232,36 +232,41 @@ in
# Enable the accounts daemon to find lightdm's dbus interface
environment.systemPackages = [ lightdm ];
security.pam.services.lightdm = {
allowNullPassword = true;
startSession = true;
};
security.pam.services.lightdm-greeter = {
allowNullPassword = true;
startSession = true;
text = ''
auth required pam_env.so envfile=${config.system.build.pamEnvironment}
auth required pam_permit.so
security.pam.services.lightdm.text = ''
auth substack login
account include login
password substack login
session include login
'';
account required pam_permit.so
security.pam.services.lightdm-greeter.text = ''
auth required pam_succeed_if.so audit quiet_success user = lightdm
auth optional pam_permit.so
password required pam_deny.so
account required pam_succeed_if.so audit quiet_success user = lightdm
account sufficient pam_unix.so
password required pam_deny.so
session required pam_succeed_if.so audit quiet_success user = lightdm
session required pam_env.so envfile=${config.system.build.pamEnvironment}
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
session optional pam_keyinit.so force revoke
session optional pam_permit.so
'';
session required pam_env.so envfile=${config.system.build.pamEnvironment}
session required pam_unix.so
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
'';
};
security.pam.services.lightdm-autologin.text = ''
auth requisite pam_nologin.so
auth required pam_succeed_if.so uid >= 1000 quiet
auth required pam_permit.so
auth requisite pam_nologin.so
account include lightdm
auth required pam_succeed_if.so uid >= 1000 quiet
auth required pam_permit.so
password include lightdm
account sufficient pam_unix.so
session include lightdm
password requisite pam_unix.so nullok sha512
session optional pam_keyinit.so revoke
session include login
'';
users.users.lightdm = {