public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/lightdm: fix pam rules

Browse Source 
Rules are a translation of what's done in the
GDM module and adjustments based of looking at
Arch Linux's configuration and upstream's.

A side effect of this change is that gnome-keyring
and kwallet modules should work as expected when in-
cluded.

Fixes #64259 #62045
This commit is contained in:
worldofpeace 2019-07-14 06:32:44 -04:00
parent 5d4890b58d
commit 0c602541a3
1 changed files with 28 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
nixos/modules/services/x11/display-managers/lightdm.nix
View File

@ -232,36 +232,41 @@ in
# Enable the accounts daemon to find lightdm's dbus interface # Enable the accounts daemon to find lightdm's dbus interface
environment.systemPackages = [ lightdm ]; environment.systemPackages = [ lightdm ];
security.pam.services.lightdm = { security.pam.services.lightdm.text = ''
allowNullPassword = true; auth substack login
startSession = true; account include login
}; password substack login
security.pam.services.lightdm-greeter = { session include login
allowNullPassword = true; '';
startSession = true;
text = ''
auth required pam_env.so envfile=${config.system.build.pamEnvironment}
auth required pam_permit.so
account required pam_permit.so security.pam.services.lightdm-greeter.text = ''
auth required pam_succeed_if.so audit quiet_success user = lightdm
auth optional pam_permit.so
password required pam_deny.so account required pam_succeed_if.so audit quiet_success user = lightdm
account sufficient pam_unix.so
password required pam_deny.so
session required pam_succeed_if.so audit quiet_success user = lightdm
session required pam_env.so envfile=${config.system.build.pamEnvironment}
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
session optional pam_keyinit.so force revoke
session optional pam_permit.so
'';
session required pam_env.so envfile=${config.system.build.pamEnvironment}
session required pam_unix.so
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
'';
};
security.pam.services.lightdm-autologin.text = '' security.pam.services.lightdm-autologin.text = ''
auth requisite pam_nologin.so auth requisite pam_nologin.so
auth required pam_succeed_if.so uid >= 1000 quiet
auth required pam_permit.so
account include lightdm auth required pam_succeed_if.so uid >= 1000 quiet
auth required pam_permit.so
password include lightdm account sufficient pam_unix.so
session include lightdm password requisite pam_unix.so nullok sha512
session optional pam_keyinit.so revoke
session include login
''; '';
users.users.lightdm = { users.users.lightdm = {