Both `pam_unix.so` and `pam_unix_ng.so` look at `ENCRYPT_METHOD` in
`/etc/login.defs` to determine the algorithm to use for password
encryption: https://github.com/thkukuk/account-utils/blob/66fbd0382be49d99cb70410a4696c796684ffbf8/src/pam_unix_ng-common.c#L27-L62
If this is not set, both already default to `YESCRYPT`.
The shadow module makes this configurable via
`security.loginDefs.settings.ENCRYPT_METHOD`, which also defaults to `YESCRYPT`.
Seeing as what was previously hardcoded is default anyways, with a global
configuration option to change it, there is no point to keep this.
We plan to use systemd-userdbd for NixOS 26.11, which will dynamically
allocate greeter users + their homes, which would break the current PA
config. GNOME already depends on PipeWire in other places, so there's
little reason to keep this around.
This fixes gdm not being able to save config changes made on the log-in
screen, such as turning on accessibility options. The new values for the
`gdm-greeter{-2,-3,-4,-5}` users map onto what userdbd would create for us.
We need writable home directories to interact with `dbus`, as well as to
populate the `/run/gdm/home/gdm-greeter/.config/environment.d/` files.
`gnome-inital-setup-done` is now seemingly called `gdm.ran-initial-setup`:
https://gitlab.gnome.org/GNOME/gdm/-/blob/gnome-50/daemon/gdm-manager.c?ref_type=heads#L64
Same issue as plasma-login-manager: the ly-autologin PAM service uses
relative module paths which fail when AppArmor is enabled.
Change the 3 non-include PAM rules to use absolute store paths via
${config.security.pam.package}/lib/security/pam_*.so.
The AppArmor PAM abstraction in pam.nix asserts that all modulePath
values be absolute paths. Relative paths like "pam_nologin.so" cause
a build failure with AppArmor enabled:
error: non-absolute PAM modulePath "pam_nologin.so" is unsupported by apparmor
GDM, SDDM, and LightDM already use absolute paths for all non-include
PAM rules. Fix plasma-login-manager to follow the same convention.
Auto-login masked part of this issue because the greeter was never
interacted with. But once the user's session gets locke, it never
unlocks because PAM doesn't allow empty passwords. This patch fixes that
behaviour.
Several modules define whole PAM service rule stacks by overwriting the
default value of the 'text' option. Instead, we disable useDefaultRules
for these services and declare a new set of rules using the 'rules'
option. This option is considered experimental and hidden from users,
but it is supported for use within nixpkgs.
PAM rules with non-absolute module paths are rejected when apparmor is
used. In general, it helps (aside from readability) for all the module
paths to be absolute, especially when the user overrides the PAM
package.
This helps correctness for systems which need to mount particular
directories (impermanence, preservation). This option has no effect if
the system does not need to mount directories / if no mountpoints exist
for this directory or its parents.
Signed-off-by: Nicolas Dumazet <nicdumz.commits@gmail.com>
When `programs.dms-shell.enable` is true, the greeter now automatically
uses the dms-shell package and its quickshell dependency from the
main program module. This ensures version consistency between the
desktop shell and the display manager greeter.
The defaults fall back to pkgs.dms-shell and pkgs.quickshell
respectively when the main program module is not enabled.
