nixos: use full path to PAM modules

PAM rules with non-absolute module paths are rejected when apparmor is
used. In general, it helps (aside from readability) for all the module
paths to be absolute, especially when the user overrides the PAM
package.

nixos/modules/security/pam.nix

@@ -2532,14 +2532,14 @@ in
 
     security.pam.services = {
       other.text = ''
-        auth     required pam_warn.so
-        auth     required pam_deny.so
-        account  required pam_warn.so
-        account  required pam_deny.so
-        password required pam_warn.so
-        password required pam_deny.so
-        session  required pam_warn.so
-        session  required pam_deny.so
+        auth     required ${package}/lib/security/pam_warn.so
+        auth     required ${package}/lib/security/pam_deny.so
+        account  required ${package}/lib/security/pam_warn.so
+        account  required ${package}/lib/security/pam_deny.so
+        password required ${package}/lib/security/pam_warn.so
+        password required ${package}/lib/security/pam_deny.so
+        session  required ${package}/lib/security/pam_warn.so
+        session  required ${package}/lib/security/pam_deny.so
       '';
 
       # Most of these should be moved to specific modules.

nixos/modules/services/display-managers/gdm.nix

@@ -384,19 +384,19 @@ in
     # GDM LFS PAM modules, adapted somehow to NixOS
     security.pam.services = {
       gdm-launch-environment.text = ''
-        auth     required       pam_succeed_if.so audit quiet_success user ingroup gdm
-        auth     optional       pam_permit.so
+        auth     required       ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user ingroup gdm
+        auth     optional       ${config.security.pam.package}/lib/security/pam_permit.so
 
-        account  required       pam_succeed_if.so audit quiet_success user ingroup gdm
-        account  sufficient     pam_unix.so
+        account  required       ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user ingroup gdm
+        account  sufficient     ${config.security.pam.package}/lib/security/pam_unix.so
 
-        password required       pam_deny.so
+        password required       ${config.security.pam.package}/lib/security/pam_deny.so
 
-        session  required       pam_succeed_if.so audit quiet_success user ingroup gdm
-        session  required       pam_env.so conffile=/etc/pam/environment readenv=0
+        session  required       ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user ingroup gdm
+        session  required       ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0
         session  optional       ${config.systemd.package}/lib/security/pam_systemd.so
-        session  optional       pam_keyinit.so force revoke
-        session  optional       pam_permit.so
+        session  optional       ${config.security.pam.package}/lib/security/pam_keyinit.so force revoke
+        session  optional       ${config.security.pam.package}/lib/security/pam_permit.so
       '';
 
       gdm-password.text = ''
@@ -407,19 +407,19 @@ in
       '';
 
       gdm-autologin.text = ''
-        auth      requisite     pam_nologin.so
-        auth      required      pam_succeed_if.so uid >= 1000 quiet
+        auth      requisite     ${config.security.pam.package}/lib/security/pam_nologin.so
+        auth      required      ${config.security.pam.package}/lib/security/pam_succeed_if.so uid >= 1000 quiet
         ${lib.optionalString (pamLogin.enable && pamLogin.enableGnomeKeyring) ''
           auth       [success=ok default=1]      ${gdm}/lib/security/pam_gdm.so
           auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so
         ''}
-        auth      required      pam_permit.so
+        auth      required      ${config.security.pam.package}/lib/security/pam_permit.so
 
-        account   sufficient    pam_unix.so
+        account   sufficient    ${config.security.pam.package}/lib/security/pam_unix.so
 
-        password  requisite     pam_unix.so nullok yescrypt
+        password  requisite     ${config.security.pam.package}/lib/security/pam_unix.so nullok yescrypt
 
-        session   optional      pam_keyinit.so revoke
+        session   optional      ${config.security.pam.package}/lib/security/pam_keyinit.so revoke
         session   include       login
       '';
 
@@ -428,11 +428,11 @@ in
       login.fprintAuth = lib.mkIf config.services.fprintd.enable false;
 
       gdm-fingerprint.text = lib.mkIf config.services.fprintd.enable ''
-        auth       required                    pam_shells.so
-        auth       requisite                   pam_nologin.so
-        auth       requisite                   pam_faillock.so      preauth
+        auth       required                    ${config.security.pam.package}/lib/security/pam_shells.so
+        auth       requisite                   ${config.security.pam.package}/lib/security/pam_nologin.so
+        auth       requisite                   ${config.security.pam.package}/lib/security/pam_faillock.so      preauth
         auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so
-        auth       required                    pam_env.so conffile=/etc/pam/environment readenv=0
+        auth       required                    ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0
         ${lib.optionalString (pamLogin.enable && pamLogin.enableGnomeKeyring) ''
           auth       [success=ok default=1]      ${gdm}/lib/security/pam_gdm.so
           auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so
@@ -440,7 +440,7 @@ in
 
         account    include                     login
 
-        password   required                    pam_deny.so
+        password   required                    ${config.security.pam.package}/lib/security/pam_deny.so
 
         session    include                     login
       '';

nixos/modules/services/display-managers/sddm.nix

@@ -376,25 +376,25 @@ in
       '';
 
       sddm-greeter.text = ''
-        auth     required       pam_succeed_if.so audit quiet_success user = sddm
-        auth     optional       pam_permit.so
+        auth     required       ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = sddm
+        auth     optional       ${config.security.pam.package}/lib/security/pam_permit.so
 
-        account  required       pam_succeed_if.so audit quiet_success user = sddm
-        account  sufficient     pam_unix.so
+        account  required       ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = sddm
+        account  sufficient     ${config.security.pam.package}/lib/security/pam_unix.so
 
-        password required       pam_deny.so
+        password required       ${config.security.pam.package}/lib/security/pam_deny.so
 
-        session  required       pam_succeed_if.so audit quiet_success user = sddm
-        session  required       pam_env.so conffile=/etc/pam/environment readenv=0
+        session  required       ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = sddm
+        session  required       ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0
         session  optional       ${config.systemd.package}/lib/security/pam_systemd.so
-        session  optional       pam_keyinit.so force revoke
-        session  optional       pam_permit.so
+        session  optional       ${config.security.pam.package}/lib/security/pam_keyinit.so force revoke
+        session  optional       ${config.security.pam.package}/lib/security/pam_permit.so
       '';
 
       sddm-autologin.text = ''
-        auth     requisite pam_nologin.so
-        auth     required  pam_succeed_if.so uid >= ${toString cfg.autoLogin.minimumUid} quiet
-        auth     required  pam_permit.so
+        auth     requisite ${config.security.pam.package}/lib/security/pam_nologin.so
+        auth     required  ${config.security.pam.package}/lib/security/pam_succeed_if.so uid >= ${toString cfg.autoLogin.minimumUid} quiet
+        auth     required  ${config.security.pam.package}/lib/security/pam_permit.so
 
         account  include   sddm
 

nixos/modules/services/networking/vsftpd.nix

@@ -334,8 +334,8 @@ in
     };
 
     security.pam.services.vsftpd.text = mkIf (cfg.enableVirtualUsers && cfg.userDbPath != null) ''
-      auth required pam_userdb.so db=${cfg.userDbPath}
-      account required pam_userdb.so db=${cfg.userDbPath}
+      auth required ${config.security.pam.package}/lib/security/pam_userdb.so db=${cfg.userDbPath}
+      account required ${config.security.pam.package}/lib/security/pam_userdb.so db=${cfg.userDbPath}
     '';
   };
 }

nixos/modules/services/wayland/cage.nix

@@ -106,10 +106,10 @@ in
     security.polkit.enable = true;
 
     security.pam.services.cage.text = ''
-      auth    required pam_unix.so nullok
-      account required pam_unix.so
-      session required pam_unix.so
-      session required pam_env.so conffile=/etc/pam/environment readenv=0
+      auth    required ${config.security.pam.package}/lib/security/pam_unix.so nullok
+      account required ${config.security.pam.package}/lib/security/pam_unix.so
+      session required ${config.security.pam.package}/lib/security/pam_unix.so
+      session required ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0
       session required ${config.systemd.package}/lib/security/pam_systemd.so
     '';
 

nixos/modules/services/x11/display-managers/lightdm.nix

@@ -288,36 +288,36 @@ in
     # https://github.com/elementary/switchboard-plug-parental-controls/blob/8.0.1/src/daemon/Server.vala#L325
     # Must specify conffile since pam_time defaults to ${linux-pam}/etc/security/time.conf.
     + lib.optionalString config.services.pantheon.parental-controls.enable ''
-      account   required      pam_time.so conffile=/etc/security/time.conf
+      account   required      ${config.security.pam.package}/lib/security/pam_time.so conffile=/etc/security/time.conf
     '';
 
     security.pam.services.lightdm-greeter.text = ''
-      auth     required       pam_succeed_if.so audit quiet_success user = lightdm
-      auth     optional       pam_permit.so
+      auth     required       ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = lightdm
+      auth     optional       ${config.security.pam.package}/lib/security/pam_permit.so
 
-      account  required       pam_succeed_if.so audit quiet_success user = lightdm
-      account  sufficient     pam_unix.so
+      account  required       ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = lightdm
+      account  sufficient     ${config.security.pam.package}/lib/security/pam_unix.so
 
-      password required       pam_deny.so
+      password required       ${config.security.pam.package}/lib/security/pam_deny.so
 
-      session  required       pam_succeed_if.so audit quiet_success user = lightdm
-      session  required       pam_env.so conffile=/etc/pam/environment readenv=0
+      session  required       ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = lightdm
+      session  required       ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0
       session  optional       ${config.systemd.package}/lib/security/pam_systemd.so
-      session  optional       pam_keyinit.so force revoke
-      session  optional       pam_permit.so
+      session  optional       ${config.security.pam.package}/lib/security/pam_keyinit.so force revoke
+      session  optional       ${config.security.pam.package}/lib/security/pam_permit.so
     '';
 
     security.pam.services.lightdm-autologin.text = ''
-      auth      requisite     pam_nologin.so
+      auth      requisite     ${config.security.pam.package}/lib/security/pam_nologin.so
 
-      auth      required      pam_succeed_if.so uid >= 1000 quiet
-      auth      required      pam_permit.so
+      auth      required      ${config.security.pam.package}/lib/security/pam_succeed_if.so uid >= 1000 quiet
+      auth      required      ${config.security.pam.package}/lib/security/pam_permit.so
 
-      account   sufficient    pam_unix.so
+      account   sufficient    ${config.security.pam.package}/lib/security/pam_unix.so
 
-      password  requisite     pam_unix.so nullok yescrypt
+      password  requisite     ${config.security.pam.package}/lib/security/pam_unix.so nullok yescrypt
 
-      session   optional      pam_keyinit.so revoke
+      session   optional      ${config.security.pam.package}/lib/security/pam_keyinit.so revoke
       session   include       login
     '';