* Apply the resource limits set by security.pam.loginLimits to all PAM

services (rather than just login(1)).  It's rather unexpected if
  resource limits are not applied to (say) users logged in via SSH or
  X11.

svn path=/nixos/trunk/; revision=28105

modules/programs/shadow.nix

@@ -87,9 +87,7 @@ in
         { name = "groupmod"; rootOK = true; } 
         { name = "groupmems"; rootOK = true; }
         { name = "groupdel"; rootOK = true; }
-        { name = "login"; ownDevices = true; allowNullPassword = true;
+        { name = "login"; ownDevices = true; allowNullPassword = true; }
-          limits = config.security.pam.loginLimits;
-        }
       ];
       
     security.setuidPrograms = [ "passwd" "chfn" "su" ];

modules/security/pam.nix

@@ -52,7 +52,7 @@ let
       # in.
       allowNullPassword ? false
     , # The limits, as per limits.conf(5).
-      limits ? []
+      limits ? config.security.pam.loginLimits
     }:
 
     { source = pkgs.writeText "${name}.pam"
@@ -132,13 +132,12 @@ in
        ];
 
      description =
-       '' Define resource limits that should apply to users or groups for the
+       '' Define resource limits that should apply to users or groups.
-          <command>login</command> service.  Each item in the list should be
+          Each item in the list should be an attribute set with a
-          an attribute set with a <varname>domain</varname>,
+          <varname>domain</varname>, <varname>type</varname>,
-          <varname>type</varname>, <varname>item</varname>, and
+          <varname>item</varname>, and <varname>value</varname>
-          <varname>value</varname> attribute.  The syntax and semantics of
+          attribute.  The syntax and semantics of these attributes
-          these attributes must be that described in the limits.conf(5) man
+          must be that described in the limits.conf(5) man page.
-          page.
        '';
     };
 
@@ -212,7 +211,6 @@ in
       setuid = true;
     } ];
 
-
     security.pam.services =
       # Most of these should be moved to specific modules.
       [ { name = "cups"; }