From 2c636c7616026704d4790a0d370051972ee691e6 Mon Sep 17 00:00:00 2001 From: Sam Pointon Date: Wed, 22 Apr 2026 21:55:16 +0100 Subject: [PATCH] nixos/pam: allow disabling entirely In containers, it can be reasonable to have no interactive logins at all and to run the container entirely 'lights out'. In this setting, PAM is dead weight, and adds considerably to container image size (mostly by bringing other things in to the closure). However, presently, there's no way to get rid of it. This change adds the coarse tool of entirely disabling PAM. There _could_ be a warning or even an assertion, but I reasoned that there might be odd cases where it's desired - and not having PAM is not something that entirely disables the system, so a hard assertion feels wrong, and there are plenty of other ways to misconfigure a system if you go looking for trouble. I am also trying not to get sucked in to the morass of reforming pam.nix more broadly to make it less cumbersome, hence the coarsity of the setting. --- nixos/modules/security/pam.nix | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 5130987bed1c..4b02ba4f59eb 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -1854,6 +1854,17 @@ in options = { + security.pam.enable = lib.mkOption { + default = true; + type = lib.types.bool; + + description = '' + Whether to enable PAM, or entirely disable it. + + Unless you're building a container image, you probably don't want to disable PAM. + ''; + }; + security.pam.package = lib.mkPackageOption pkgs "pam" { }; security.pam.loginLimits = lib.mkOption { @@ -2475,7 +2486,7 @@ in ###### implementation - config = { + config = lib.mkIf config.security.pam.enable { assertions = [ { assertion = config.users.motd == "" || config.users.motdFile == null;