session and seat management daemon
fix(nix): simplify pam sessiond registration
+34
-41
+18
-1
docs/INSTALL.md
+18
-1
docs/INSTALL.md
···
53
53
enable it for any other session-opening PAM service
54
54
too, such as `gdm`, `sddm`, `greetd` or `hilsed`.
55
55
56
+
On NixOS:
57
+
56
58
```nix
57
59
{
58
-
security.pam.services.<service>.sessiond = true;
60
+
security.pam.services.<service>.rules.session.sessiond = {
61
+
control = "optional";
62
+
modulePath = "${config.services.sessiond.package}/lib/security/pam_sessiond.so";
63
+
order = 900;
64
+
};
65
+
}
66
+
```
67
+
68
+
On finix:
69
+
70
+
```nix
71
+
{ lib, config, ... }:
72
+
{
73
+
security.pam.services.<service>.text = lib.mkAfter ''
74
+
session optional ${config.services.sessiond.package}/lib/security/pam_sessiond.so
75
+
'';
59
76
}
60
77
```
61
78
+6
-6
nix/common.nix
+6
-6
nix/common.nix
···
38
38
};
39
39
40
40
config = lib.mkIf cfg.enable {
41
-
services.sessiond.settings.default-seat = lib.mkDefault "seat0";
42
-
services.sessiond.settings.seats.seat0 = {
43
-
user = lib.mkDefault "root";
44
-
group = lib.mkDefault "seat";
41
+
services.sessiond.settings = {
42
+
default-seat = lib.mkDefault cfg.settings.seats.seat0.group;
43
+
seats.seat0 = {
44
+
user = lib.mkDefault "root";
45
+
group = lib.mkDefault "seat";
46
+
};
45
47
};
46
48
47
49
environment.systemPackages = [ cfg.package ];
48
50
services.dbus.packages = [ cfg.package ];
49
51
50
52
users.groups = lib.genAttrs seatGroups (_: { });
51
-
52
-
security.pam.services.login.sessiond = lib.mkDefault true;
53
53
};
54
54
}
+4
-17
nix/finix.nix
+4
-17
nix/finix.nix
···
12
12
{
13
13
imports = [ ./common.nix ];
14
14
15
-
options.security.pam.services = lib.mkOption {
16
-
type = lib.types.attrsOf (
17
-
lib.types.submodule (
18
-
{ config, ... }:
19
-
{
20
-
options.sessiond = lib.mkEnableOption "opening sessiond sessions";
21
-
22
-
config.text = lib.mkIf config.sessiond (
23
-
lib.mkAfter ''
24
-
session optional ${cfg.package}/lib/security/pam_sessiond.so
25
-
''
26
-
);
27
-
}
28
-
)
29
-
);
30
-
};
31
-
32
15
config = lib.mkIf cfg.enable {
33
16
finit = {
34
17
services.sessiond = {
···
39
22
log = true;
40
23
};
41
24
};
25
+
26
+
security.pam.services.login.text = lib.mkAfter ''
27
+
session optional ${cfg.package}/lib/security/pam_sessiond.so
28
+
'';
42
29
43
30
services.polkit.package = pkgs.callPackage ./polkit {
44
31
useConsoleKit = true;
+6
-17
nix/nixos.nix
+6
-17
nix/nixos.nix
···
12
12
{
13
13
imports = [ ./common.nix ];
14
14
15
-
options.security.pam.services = lib.mkOption {
16
-
type = lib.types.attrsOf (
17
-
lib.types.submodule (
18
-
{ config, ... }:
19
-
{
20
-
options.sessiond = lib.mkEnableOption "opening sessiond sessions";
21
-
22
-
config.rules.session.sessiond = lib.mkIf config.sessiond {
23
-
control = "optional";
24
-
modulePath = "${cfg.package}/lib/security/pam_sessiond.so";
25
-
order = 900;
26
-
};
27
-
}
28
-
)
29
-
);
30
-
};
31
-
32
15
config = lib.mkIf cfg.enable {
33
16
systemd.services.sessiond = {
34
17
description = "session management daemon";
···
39
22
Environment = "LOG_LEVEL=${cfg.logLevel}";
40
23
Delegate = true;
41
24
};
25
+
};
26
+
27
+
security.pam.services.login.rules.session.sessiond = {
28
+
control = "optional";
29
+
modulePath = "${cfg.package}/lib/security/pam_sessiond.so";
30
+
order = 900;
42
31
};
43
32
44
33
security.polkit.package = pkgs.callPackage ./polkit {