diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index d568b32a45a3..15a889ac7e11 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -2532,14 +2532,14 @@ in security.pam.services = { other.text = '' - auth required pam_warn.so - auth required pam_deny.so - account required pam_warn.so - account required pam_deny.so - password required pam_warn.so - password required pam_deny.so - session required pam_warn.so - session required pam_deny.so + auth required ${package}/lib/security/pam_warn.so + auth required ${package}/lib/security/pam_deny.so + account required ${package}/lib/security/pam_warn.so + account required ${package}/lib/security/pam_deny.so + password required ${package}/lib/security/pam_warn.so + password required ${package}/lib/security/pam_deny.so + session required ${package}/lib/security/pam_warn.so + session required ${package}/lib/security/pam_deny.so ''; # Most of these should be moved to specific modules. diff --git a/nixos/modules/services/display-managers/gdm.nix b/nixos/modules/services/display-managers/gdm.nix index 62b90efa92b9..18998ddeb34f 100644 --- a/nixos/modules/services/display-managers/gdm.nix +++ b/nixos/modules/services/display-managers/gdm.nix @@ -384,19 +384,19 @@ in # GDM LFS PAM modules, adapted somehow to NixOS security.pam.services = { gdm-launch-environment.text = '' - auth required pam_succeed_if.so audit quiet_success user ingroup gdm - auth optional pam_permit.so + auth required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user ingroup gdm + auth optional ${config.security.pam.package}/lib/security/pam_permit.so - account required pam_succeed_if.so audit quiet_success user ingroup gdm - account sufficient pam_unix.so + account required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user ingroup gdm + account sufficient ${config.security.pam.package}/lib/security/pam_unix.so - password required pam_deny.so + password required ${config.security.pam.package}/lib/security/pam_deny.so - session required pam_succeed_if.so audit quiet_success user ingroup gdm - session required pam_env.so conffile=/etc/pam/environment readenv=0 + session required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user ingroup gdm + session required ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0 session optional ${config.systemd.package}/lib/security/pam_systemd.so - session optional pam_keyinit.so force revoke - session optional pam_permit.so + session optional ${config.security.pam.package}/lib/security/pam_keyinit.so force revoke + session optional ${config.security.pam.package}/lib/security/pam_permit.so ''; gdm-password.text = '' @@ -407,19 +407,19 @@ in ''; gdm-autologin.text = '' - auth requisite pam_nologin.so - auth required pam_succeed_if.so uid >= 1000 quiet + auth requisite ${config.security.pam.package}/lib/security/pam_nologin.so + auth required ${config.security.pam.package}/lib/security/pam_succeed_if.so uid >= 1000 quiet ${lib.optionalString (pamLogin.enable && pamLogin.enableGnomeKeyring) '' auth [success=ok default=1] ${gdm}/lib/security/pam_gdm.so auth optional ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so ''} - auth required pam_permit.so + auth required ${config.security.pam.package}/lib/security/pam_permit.so - account sufficient pam_unix.so + account sufficient ${config.security.pam.package}/lib/security/pam_unix.so - password requisite pam_unix.so nullok yescrypt + password requisite ${config.security.pam.package}/lib/security/pam_unix.so nullok yescrypt - session optional pam_keyinit.so revoke + session optional ${config.security.pam.package}/lib/security/pam_keyinit.so revoke session include login ''; @@ -428,11 +428,11 @@ in login.fprintAuth = lib.mkIf config.services.fprintd.enable false; gdm-fingerprint.text = lib.mkIf config.services.fprintd.enable '' - auth required pam_shells.so - auth requisite pam_nologin.so - auth requisite pam_faillock.so preauth + auth required ${config.security.pam.package}/lib/security/pam_shells.so + auth requisite ${config.security.pam.package}/lib/security/pam_nologin.so + auth requisite ${config.security.pam.package}/lib/security/pam_faillock.so preauth auth required ${pkgs.fprintd}/lib/security/pam_fprintd.so - auth required pam_env.so conffile=/etc/pam/environment readenv=0 + auth required ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0 ${lib.optionalString (pamLogin.enable && pamLogin.enableGnomeKeyring) '' auth [success=ok default=1] ${gdm}/lib/security/pam_gdm.so auth optional ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so @@ -440,7 +440,7 @@ in account include login - password required pam_deny.so + password required ${config.security.pam.package}/lib/security/pam_deny.so session include login ''; diff --git a/nixos/modules/services/display-managers/sddm.nix b/nixos/modules/services/display-managers/sddm.nix index b960c7e63d8d..25f63007f9ac 100644 --- a/nixos/modules/services/display-managers/sddm.nix +++ b/nixos/modules/services/display-managers/sddm.nix @@ -376,25 +376,25 @@ in ''; sddm-greeter.text = '' - auth required pam_succeed_if.so audit quiet_success user = sddm - auth optional pam_permit.so + auth required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = sddm + auth optional ${config.security.pam.package}/lib/security/pam_permit.so - account required pam_succeed_if.so audit quiet_success user = sddm - account sufficient pam_unix.so + account required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = sddm + account sufficient ${config.security.pam.package}/lib/security/pam_unix.so - password required pam_deny.so + password required ${config.security.pam.package}/lib/security/pam_deny.so - session required pam_succeed_if.so audit quiet_success user = sddm - session required pam_env.so conffile=/etc/pam/environment readenv=0 + session required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = sddm + session required ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0 session optional ${config.systemd.package}/lib/security/pam_systemd.so - session optional pam_keyinit.so force revoke - session optional pam_permit.so + session optional ${config.security.pam.package}/lib/security/pam_keyinit.so force revoke + session optional ${config.security.pam.package}/lib/security/pam_permit.so ''; sddm-autologin.text = '' - auth requisite pam_nologin.so - auth required pam_succeed_if.so uid >= ${toString cfg.autoLogin.minimumUid} quiet - auth required pam_permit.so + auth requisite ${config.security.pam.package}/lib/security/pam_nologin.so + auth required ${config.security.pam.package}/lib/security/pam_succeed_if.so uid >= ${toString cfg.autoLogin.minimumUid} quiet + auth required ${config.security.pam.package}/lib/security/pam_permit.so account include sddm diff --git a/nixos/modules/services/networking/vsftpd.nix b/nixos/modules/services/networking/vsftpd.nix index 3a129f1a610e..070f77115829 100644 --- a/nixos/modules/services/networking/vsftpd.nix +++ b/nixos/modules/services/networking/vsftpd.nix @@ -334,8 +334,8 @@ in }; security.pam.services.vsftpd.text = mkIf (cfg.enableVirtualUsers && cfg.userDbPath != null) '' - auth required pam_userdb.so db=${cfg.userDbPath} - account required pam_userdb.so db=${cfg.userDbPath} + auth required ${config.security.pam.package}/lib/security/pam_userdb.so db=${cfg.userDbPath} + account required ${config.security.pam.package}/lib/security/pam_userdb.so db=${cfg.userDbPath} ''; }; } diff --git a/nixos/modules/services/wayland/cage.nix b/nixos/modules/services/wayland/cage.nix index e39e31ef6272..76731622d50a 100644 --- a/nixos/modules/services/wayland/cage.nix +++ b/nixos/modules/services/wayland/cage.nix @@ -106,10 +106,10 @@ in security.polkit.enable = true; security.pam.services.cage.text = '' - auth required pam_unix.so nullok - account required pam_unix.so - session required pam_unix.so - session required pam_env.so conffile=/etc/pam/environment readenv=0 + auth required ${config.security.pam.package}/lib/security/pam_unix.so nullok + account required ${config.security.pam.package}/lib/security/pam_unix.so + session required ${config.security.pam.package}/lib/security/pam_unix.so + session required ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0 session required ${config.systemd.package}/lib/security/pam_systemd.so ''; diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix index 467207ecd92b..b0e757b21f5f 100644 --- a/nixos/modules/services/x11/display-managers/lightdm.nix +++ b/nixos/modules/services/x11/display-managers/lightdm.nix @@ -288,36 +288,36 @@ in # https://github.com/elementary/switchboard-plug-parental-controls/blob/8.0.1/src/daemon/Server.vala#L325 # Must specify conffile since pam_time defaults to ${linux-pam}/etc/security/time.conf. + lib.optionalString config.services.pantheon.parental-controls.enable '' - account required pam_time.so conffile=/etc/security/time.conf + account required ${config.security.pam.package}/lib/security/pam_time.so conffile=/etc/security/time.conf ''; security.pam.services.lightdm-greeter.text = '' - auth required pam_succeed_if.so audit quiet_success user = lightdm - auth optional pam_permit.so + auth required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = lightdm + auth optional ${config.security.pam.package}/lib/security/pam_permit.so - account required pam_succeed_if.so audit quiet_success user = lightdm - account sufficient pam_unix.so + account required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = lightdm + account sufficient ${config.security.pam.package}/lib/security/pam_unix.so - password required pam_deny.so + password required ${config.security.pam.package}/lib/security/pam_deny.so - session required pam_succeed_if.so audit quiet_success user = lightdm - session required pam_env.so conffile=/etc/pam/environment readenv=0 + session required ${config.security.pam.package}/lib/security/pam_succeed_if.so audit quiet_success user = lightdm + session required ${config.security.pam.package}/lib/security/pam_env.so conffile=/etc/pam/environment readenv=0 session optional ${config.systemd.package}/lib/security/pam_systemd.so - session optional pam_keyinit.so force revoke - session optional pam_permit.so + session optional ${config.security.pam.package}/lib/security/pam_keyinit.so force revoke + session optional ${config.security.pam.package}/lib/security/pam_permit.so ''; security.pam.services.lightdm-autologin.text = '' - auth requisite pam_nologin.so + auth requisite ${config.security.pam.package}/lib/security/pam_nologin.so - auth required pam_succeed_if.so uid >= 1000 quiet - auth required pam_permit.so + auth required ${config.security.pam.package}/lib/security/pam_succeed_if.so uid >= 1000 quiet + auth required ${config.security.pam.package}/lib/security/pam_permit.so - account sufficient pam_unix.so + account sufficient ${config.security.pam.package}/lib/security/pam_unix.so - password requisite pam_unix.so nullok yescrypt + password requisite ${config.security.pam.package}/lib/security/pam_unix.so nullok yescrypt - session optional pam_keyinit.so revoke + session optional ${config.security.pam.package}/lib/security/pam_keyinit.so revoke session include login '';