···

       
223
       
 
       
        '';

     

       
224
       
 
       
      };

     

       
225
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
226
       
 
       
      text = mkOption {

     

       
227
       
 
       
        type = types.nullOr types.lines;

     

       
228
       
 
       
        description = "Contents of the PAM service file.";

     
···

       
273
       
 
       
          # prompts the user for password so we run it once with 'required' at an

     

       
274
       
 
       
          # earlier point and it will run again with 'sufficient' further down.

     

       
275
       
 
       
          # We use try_first_pass the second time to avoid prompting password twice

     

       
276
       
-
       
          (optionalString (cfg.unixAuth && (config.security.pam.enableEcryptfs || cfg.pamMount || cfg.enableKwallet)) ''

     

       
277
       
 
       
              auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth

     

       
278
       
 
       
              ${optionalString config.security.pam.enableEcryptfs

     

       
279
       
 
       
                "auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}

     
···

       
282
       
 
       
              ${optionalString cfg.enableKwallet

     

       
283
       
 
       
                ("auth optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" +

     

       
284
       
 
       
                 " kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}

     

       
0
       
 
       

     

       
0
       
 
       

     

       
285
       
 
       
            '') + ''

     

       
286
       
 
       
          ${optionalString cfg.unixAuth

     

       
287
       
 
       
              "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth try_first_pass"}

     
···

       
351
       
 
       
          ${optionalString (cfg.enableKwallet)

     

       
352
       
 
       
              ("session optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" +

     

       
353
       
 
       
               " kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}

     

       
0
       
 
       

     

       
0
       
 
       

     

       
354
       
 
       
          ${optionalString (config.virtualisation.lxc.lxcfs.enable)

     

       
355
       
 
       
               "session optional ${pkgs.lxcfs}/lib/security/pam_cgfs.so -c freezer,memory,name=systemd,unified,cpuset"}

     

       
356
       
 
       
        '');

     

···

       
223
       
 
       
        '';

     

       
224
       
 
       
      };

     

       
225
       
 
       


     

       
226
       
+
       
      enableGnomeKeyring = mkOption {

     

       
227
       
+
       
        default = false;

     

       
228
       
+
       
        type = types.bool;

     

       
229
       
+
       
        description = ''

     

       
230
       
+
       
          If enabled, pam_gnome_keyring will attempt to automatically unlock the

     

       
231
       
+
       
          user's default Gnome keyring upon login. If the user login password does

     

       
232
       
+
       
          not match their keyring password, Gnome Keyring will prompt separately

     

       
233
       
+
       
          after login.

     

       
234
       
+
       
        '';

     

       
235
       
+
       
      };

     

       
236
       
+
       


     

       
237
       
 
       
      text = mkOption {

     

       
238
       
 
       
        type = types.nullOr types.lines;

     

       
239
       
 
       
        description = "Contents of the PAM service file.";

     
···

       
284
       
 
       
          # prompts the user for password so we run it once with 'required' at an

     

       
285
       
 
       
          # earlier point and it will run again with 'sufficient' further down.

     

       
286
       
 
       
          # We use try_first_pass the second time to avoid prompting password twice

     

       
287
       
+
       
          (optionalString (cfg.unixAuth && (config.security.pam.enableEcryptfs || cfg.pamMount || cfg.enableKwallet || cfg.enableGnomeKeyring)) ''

     

       
288
       
 
       
              auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth

     

       
289
       
 
       
              ${optionalString config.security.pam.enableEcryptfs

     

       
290
       
 
       
                "auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}

     
···

       
293
       
 
       
              ${optionalString cfg.enableKwallet

     

       
294
       
 
       
                ("auth optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" +

     

       
295
       
 
       
                 " kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}

     

       
296
       
+
       
              ${optionalString cfg.enableGnomeKeyring

     

       
297
       
+
       
                ("auth optional ${pkgs.gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so")}

     

       
298
       
 
       
            '') + ''

     

       
299
       
 
       
          ${optionalString cfg.unixAuth

     

       
300
       
 
       
              "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth try_first_pass"}

     
···

       
364
       
 
       
          ${optionalString (cfg.enableKwallet)

     

       
365
       
 
       
              ("session optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" +

     

       
366
       
 
       
               " kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}

     

       
367
       
+
       
          ${optionalString (cfg.enableGnomeKeyring)

     

       
368
       
+
       
              "session optional ${pkgs.gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so auto_start"}

     

       
369
       
 
       
          ${optionalString (config.virtualisation.lxc.lxcfs.enable)

     

       
370
       
 
       
               "session optional ${pkgs.lxcfs}/lib/security/pam_cgfs.so -c freezer,memory,name=systemd,unified,cpuset"}

     

       
371
       
 
       
        '');