From cffbe413593f1d442b8ab7d86b7624d34ab9f563 Mon Sep 17 00:00:00 2001
From: hydroakri <24475059+hydroakri@users.noreply.github.com>
Date: Sat, 16 May 2026 02:21:07 +0000
Subject: [PATCH] nixos/plasma-login-manager: use absolute PAM module paths

The AppArmor PAM abstraction in pam.nix asserts that all modulePath
values be absolute paths. Relative paths like "pam_nologin.so" cause
a build failure with AppArmor enabled:

  error: non-absolute PAM modulePath "pam_nologin.so" is unsupported by apparmor

GDM, SDDM, and LightDM already use absolute paths for all non-include
PAM rules. Fix plasma-login-manager to follow the same convention.
---
 .../display-managers/plasma-login-manager.nix      | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/services/display-managers/plasma-login-manager.nix b/nixos/modules/services/display-managers/plasma-login-manager.nix
index 4c98f75b8973..65a16671bda0 100644
--- a/nixos/modules/services/display-managers/plasma-login-manager.nix
+++ b/nixos/modules/services/display-managers/plasma-login-manager.nix
@@ -125,12 +125,12 @@ in
             {
               name = "nologin";
               control = "requisite";
-              modulePath = "pam_nologin.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_nologin.so";
             }
             {
               name = "permit";
               control = "required";
-              modulePath = "pam_permit.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_permit.so";
             }
           ];
 
@@ -166,7 +166,7 @@ in
               # Load environment from /etc/environment and ~/.pam_environment
               name = "env";
               control = "required";
-              modulePath = "pam_env.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
               settings.conffile = "/etc/pam/environment";
               settings.readenv = 0;
             }
@@ -174,7 +174,7 @@ in
               # Always let the greeter start without authentication
               name = "permit";
               control = "required";
-              modulePath = "pam_permit.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_permit.so";
             }
           ];
 
@@ -183,7 +183,7 @@ in
               # No action required for account management
               name = "permit";
               control = "required";
-              modulePath = "pam_permit.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_permit.so";
             }
           ];
 
@@ -192,7 +192,7 @@ in
               # Can't change password
               name = "deny";
               control = "required";
-              modulePath = "pam_deny.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_deny.so";
             }
           ];
 
@@ -201,7 +201,7 @@ in
               # Setup session
               name = "unix";
               control = "required";
-              modulePath = "pam_unix.so";
+              modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
             }
             {
               name = "systemd";