b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

nixos: reduce pam files rebuilds on updates

Browse source 
Before whenever environment variables changed, pam files had to be
rebuild.

This is expensive since each file needs its own sandbox set up.
This commit is contained in:
Jörg Thalheim 2021-07-28 06:28:25 +02:00
parent 3dcb36f234
commit 1645acf1d3
6 changed files with 35 additions and 37 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
nixos/modules/config/system-environment.nix
View file

@ -65,9 +65,7 @@ in
};
config = {
system.build.pamEnvironment =
let
environment.etc."pam/environment".text = let
suffixedVariables =
flip mapAttrs cfg.profileRelativeSessionVariables (envVar: suffixes:
flip concatMap cfg.profiles (profile:
@ -98,9 +96,9 @@ in
(mapAttrs (n: toList) cfg.sessionVariables)
suffixedVariables
]));
in
pkgs.writeText "pam-environment" "${pamVariables}\n";
in ''
${pamVariables}
'';
};
}

2
nixos/modules/security/pam.nix
View file

@ -475,7 +475,7 @@ let
# Session management.
${optionalString cfg.setEnvironment ''
session required pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
session required pam_env.so conffile=/etc/pam/environment readenv=0
''}
session required pam_unix.so
${optionalString cfg.setLoginUid

2
nixos/modules/services/wayland/cage.nix
View file

@ -82,7 +82,7 @@ in {
auth required pam_unix.so nullok
account required pam_unix.so
session required pam_unix.so
session required pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
session required pam_env.so conffile=/etc/pam/environment readenv=0
session required ${pkgs.systemd}/lib/security/pam_systemd.so
'';

2
nixos/modules/services/x11/display-managers/gdm.nix
View file

@ -309,7 +309,7 @@ in
password required pam_deny.so
session required pam_succeed_if.so audit quiet_success user = gdm
session required pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
session required pam_env.so conffile=/etc/pam/environment readenv=0
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
session optional pam_keyinit.so force revoke
session optional pam_permit.so

2
nixos/modules/services/x11/display-managers/lightdm.nix
View file

@ -284,7 +284,7 @@ in
password required pam_deny.so
session required pam_succeed_if.so audit quiet_success user = lightdm
session required pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
session required pam_env.so conffile=/etc/pam/environment readenv=0
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
session optional pam_keyinit.so force revoke
session optional pam_permit.so

2
nixos/modules/services/x11/display-managers/sddm.nix
View file

@ -229,7 +229,7 @@ in
password required pam_deny.so
session required pam_succeed_if.so audit quiet_success user = sddm
session required pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
session required pam_env.so conffile=/etc/pam/environment readenv=0
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
session optional pam_keyinit.so force revoke
session optional pam_permit.so