about summary refs log tree commit diff
path: root/nixos/modules/security
diff options
context:
space:
mode:
authorEelco Dolstra <eelco.dolstra@logicblox.com>2014-04-17 11:35:18 +0200
committerEelco Dolstra <eelco.dolstra@logicblox.com>2014-04-17 11:35:18 +0200
commit5378da25a027f73bbbb25e1d111499f3b7dba2e8 (patch)
tree8efdcba0c42e03942d0e74943e7e7c4fb210e986 /nixos/modules/security
parentf0a9703f7784e4759a6704606346920c78a9095d (diff)
downloadnixlib-5378da25a027f73bbbb25e1d111499f3b7dba2e8.tar
nixlib-5378da25a027f73bbbb25e1d111499f3b7dba2e8.tar.gz
nixlib-5378da25a027f73bbbb25e1d111499f3b7dba2e8.tar.bz2
nixlib-5378da25a027f73bbbb25e1d111499f3b7dba2e8.tar.lz
nixlib-5378da25a027f73bbbb25e1d111499f3b7dba2e8.tar.xz
nixlib-5378da25a027f73bbbb25e1d111499f3b7dba2e8.tar.zst
nixlib-5378da25a027f73bbbb25e1d111499f3b7dba2e8.zip
Apply pam_loginuid before pam_systemd
As recommended by the pam_systemd manpage.
Diffstat (limited to 'nixos/modules/security')
-rw-r--r--nixos/modules/security/pam.nix4
1 files changed, 2 insertions, 2 deletions
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 0d205ce07e56..6a5eb4c720f8 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -187,6 +187,8 @@ let
 
           # Session management.
           session required pam_unix.so
+          ${optionalString cfg.setLoginUid
+              "session required pam_loginuid.so"}
           ${optionalString cfg.updateWtmp
               "session required ${pkgs.pam}/lib/security/pam_lastlog.so silent"}
           ${optionalString config.users.ldap.enable
@@ -197,8 +199,6 @@ let
               "session optional ${pkgs.otpw}/lib/security/pam_otpw.so"}
           ${optionalString cfg.startSession
               "session optional ${pkgs.systemd}/lib/security/pam_systemd.so"}
-          ${optionalString cfg.setLoginUid
-              "session required pam_loginuid.so"}
           ${optionalString cfg.forwardXAuth
               "session optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99"}
           ${optionalString (cfg.limits != [])