linux-pam: 1.6.1 -> 1.7.1 #418255

LordGrimmauld · 2025-06-19T20:29:46Z

PAM now uses meson to build, so the package needed to essentially be rewritten.
PAM also now uses logind for login limits. To not get infinite recursion, PAM was first stripped from systemdMinimal, then systemdMinimal was used as logind lib.

Things done

Add a 👍 reaction to pull requests you find important.

LordGrimmauld · 2025-06-19T20:35:15Z

Building docs is super painful

marcin-serwin · 2025-07-27T19:06:00Z

I was able to build the docs with the following patch:

diff --git a/pkgs/by-name/li/linux-pam/package.nix b/pkgs/by-name/li/linux-pam/package.nix
index ddd7a6db0d..6c00e445e1 100644
--- a/pkgs/by-name/li/linux-pam/package.nix
+++ b/pkgs/by-name/li/linux-pam/package.nix
@@ -16,6 +16,12 @@
   meson,
   pkg-config,
   systemdMinimal,
+  libxslt,
+  libxml2,
+  docbook_xsl_ns,
+  docbook5,
+  findXMLCatalogs,
+  w3m-batch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -43,8 +49,8 @@
 
   outputs = [
     "out"
-    # "doc"
-    # "man"
+    "doc"
+    "man"
     # "modules"
   ];
 
@@ -57,6 +63,13 @@
     ninja
     pkg-config
     gettext
+
+    libxslt
+    libxml2
+    w3m-batch
+    findXMLCatalogs
+    docbook_xsl_ns
+    docbook5
   ];
 
   buildInputs = [
@@ -71,6 +84,7 @@
 
   enableParallelBuilding = true;
 
+  mesonAutoFeatures = "auto";
   mesonFlags = [
     (lib.mesonEnable "logind" stdenv.buildPlatform.isLinux)
     (lib.mesonEnable "audit" stdenv.buildPlatform.isLinux)
@@ -81,7 +95,6 @@
     (lib.mesonEnable "elogind" false)
     (lib.mesonEnable "selinux" false)
     (lib.mesonEnable "nis" false)
-    (lib.mesonEnable "docs" false)
     (lib.mesonBool "xtests" false)
     (lib.mesonBool "examples" false)
   ];

LordGrimmauld · 2025-07-27T19:28:25Z

Damn, nice work! I'll see to getting that patch in here and rebasing to solve the merge conflicts. docbook was painful to work with, not super discoverable what is missing. This is very helpful!

pkgs/by-name/li/linux-pam/package.nix

pkgs/by-name/li/libeconf/package.nix

LordGrimmauld · 2025-07-28T11:51:02Z

All the tests pass on aarch64, and at least the build passes on x86_64

arianvp · 2025-07-28T12:18:54Z

pkgs/by-name/li/linux-pam/package.nix

+  mesonFlags = [
+    (lib.mesonEnable "logind" stdenv.buildPlatform.isLinux)
+    (lib.mesonEnable "audit" stdenv.buildPlatform.isLinux)
+    (lib.mesonEnable "pam_lastlog" true) # TODO: switch to pam_lastlog2


Should we file a ticket for this?

The switch to lastlog2 was planned for a while, just, noone actually did it yet because that needs module changes. I can file a ticket, sure. But the old lastlog and lastlog2 are not mutually exclusive, so if we do that switch we don't immediately need to disable old lastlog. Maybe TODO: remove after switch to lastlog2 would have been a better comment...

We had work on lastlog2 in #282337, and it seems our util-linux is new enough to now contain the lastlog2 code (i have not checked whether we enable the build though). I can try how far i get with that, but that is an orthogonal change (should not block this PAM update)

I opened #429075

SuperSandro2000

just a small side node

pkgs/os-specific/linux/systemd/default.nix

SuperSandro2000 · 2025-07-28T12:22:48Z

pkgs/os-specific/linux/systemd/default.nix

@@ -205,6 +205,8 @@ let
  #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
  #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
  releaseTimestamp = "1734643670";
+
+  kbd' = if withPam then kbd else kbd.override { withVlock = false; };


Suggested change

kbd' = if withPam then kbd else kbd.override { withVlock = false; };

kbd' = kbd.override { withVlock = !withPam; };

LordGrimmauld · 2025-07-28T12:40:46Z

Also: I just realized pkgsMusl.pam gives inf rec, so that needs fixing before this is ready...

LordGrimmauld · 2025-07-28T13:42:18Z

Okay, no more inf rec on musl. Required disabling nspawn for systemdLibs, and removing getent (its just used for checking the build configuration outside nspawn).

That said: the patches to make nspawn optional can be removed for systemd 258. Considering we will do a 25.05 staging next, there is no rush and #427968 should probably be merged first.

LordGrimmauld · 2025-07-28T13:42:50Z

pkgs/os-specific/linux/systemd/default.nix

+
+    # add nspawn build option flag
+    # required to disable nspawn for systemdLibs to avoid dependency on getent
+    # https://github.com/systemd/systemd/pull/36876, remove for systemd 258
+    (fetchpatch {
+      # required for the actual patch to apply
+      url = "https://github.com/systemd/systemd/commit/b1fb2d971c810e0bdf9ff0ae567a1c6c230e4e5d.patch";
+      hash = "sha256-JBheazg1OFkx8vUl2l8+34BoEPVURBQJHxqntOBYB60=";
+      includes = [ "src/nspawn/meson.build" ];
+    })
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/d95818f5221d9b9b19648cffa0cb2407f023b27e.patch";
+      hash = "sha256-FTpWGec5ivlkyEEDMCPaLE+BH91e7JI0kH8pS88bBDY=";
+      excludes = [ "test/fuzz/meson.build" ];
+    })


TODO: wait for #427968

Does anyone even care about linux-pam on musl? Seems like a pretty esoteric use-case to me. I'd want to avoid waiting for the next systemd release (which will takes weeks if not months to land) as the rest of the PR is ready.

Maybe we just disable the logind support for now in pam on musl on since that wasn't present before either and re-enable it once we have the new systemd version.

thats not the issue. Even if things don't work they should still build. systemd is still required on musl, after all.
The patches exist and seem to work fine, so if the conclusion is not to wait then probably this is ready as-is.

I hesitate to say it's a good idea to add patches to systemd to disable something so that some other software can build on a platform systemd doesn't even support.

What I'm thinking is basically something like this to make it build on musl:

index 13e8f55b1f39..21bc5114e38d 100644 --- i/pkgs/by-name/li/linux-pam/package.nix +++ w/pkgs/by-name/li/linux-pam/package.nix @@ -66,16 +66,19 @@ stdenv.mkDerivation (finalAttrs: { db4 libxcrypt ] - ++ lib.optionals stdenv.buildPlatform.isLinux [ - audit - systemdLibs - ]; + ++ lib.optionals stdenv.buildPlatform.isLinux ( + [ + audit + ] + ++ lib.optionals (!stdenv.hostPlatform.isMusl) [ + systemdLibs + ] + ); enableParallelBuilding = true; mesonAutoFeatures = "auto"; mesonFlags = [ - (lib.mesonEnable "logind" stdenv.buildPlatform.isLinux) (lib.mesonEnable "audit" stdenv.buildPlatform.isLinux) (lib.mesonEnable "pam_lastlog" (!stdenv.hostPlatform.isMusl)) # TODO: switch to pam_lastlog2, pam_lastlog is deprecated and broken on ml (lib.mesonEnable "pam_unix" true) @@ -87,6 +90,9 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonEnable "nis" false) (lib.mesonBool "xtests" false) (lib.mesonBool "examples" false) + ] + ++ lib.optionals (!stdenv.hostPlatform.isMusl) [ + (lib.mesonEnable "logind" stdenv.buildPlatform.isLinux) ]; doCheck = false; # fails

I'd say we could even get away with not enabling logind at all (for any hostPlatform) because we didn't enable it before and it wasn't even introduced in this release. It was in linux-pam for a while (at least since 1.5.3, see this PR). In a way, you enabling logind here has nothing to do with upgrading the package.

I'm happy with waiting to enable logind support until the next systemd version. But we should get this package bumped asap. This would also allow us to avoid the dance with kbd and systemd entirely.

utmp has to die, and if logind is the replacement, we should enable it. pam was/is unmaintained in nixpkgs, it was long overdue someone actually took a look at it. As it stands, this PR is a full "lets do it properly" PR.
I also don't see the issue with patching in the nspawn toggle: our systemdLibs does not install nspawn anyways, so we might as well not build it either. This does not actually change anything in the package output, so i am not sure what the fuss is about.

pkgs/by-name/kb/kbd/package.nix

pkgs/by-name/li/linux-pam/package.nix

LordGrimmauld · 2025-07-28T15:35:13Z

Hmm, seems musl still fails (this time not inf rec):
meson.build:423:4: ERROR: Problem encountered: pam_lastlog module is enabled but logwtmp() is not available

Not sure how to fix this now. We might have to just disable pam_lastlog and try to do the lastlog2 transition instead

LordGrimmauld · 2025-07-28T16:42:08Z

pr fail seems to be rate-limit issue, i'll try to restart that

arianvp · 2025-07-28T18:54:30Z

Hmm, seems musl still fails (this time not inf rec): meson.build:423:4: ERROR: Problem encountered: pam_lastlog module is enabled but logwtmp() is not available

Not sure how to fix this now. We might have to just disable pam_lastlog and try to do the lastlog2 transition instead

Did this ever work?

https://www.openwall.com/lists/musl/2013/12/04/11 seems to suggest this has been an issue for more than a decade.

pkgs/by-name/li/linux-pam/package.nix

LordGrimmauld · 2025-07-28T19:25:17Z

#404169
indeed seems this was broken before. So yes, we should probably switch to lastlog2 in hopes of also fixing musl. I suppose lastlog not being built is fine then. We still don't want the inf rec, but disabling lastlog on musl seems reasonable then.

PAM switched to meson build upstream, which requires some care: - build with logind support - reenable lastlog - clean up autotools remnants - disable debug as it slows down test making it fail

Co-Authored-by: Marcin Serwin <marcin@serwin.dev>

LordGrimmauld force-pushed the linux-pam-1.7.1 branch 2 times, most recently from 7093f80 to 849ce72 Compare June 21, 2025 15:45

nixpkgs-ci bot added the 2.status: merge conflict This PR has merge conflicts with the target branch label Jul 2, 2025

brianmcgillion mentioned this pull request Jul 4, 2025

Update Request: linux-pam 1.6.1 → 1.7.1 #422179

Closed

3 tasks

LordGrimmauld force-pushed the linux-pam-1.7.1 branch 2 times, most recently from 2d84a35 to 8370c0c Compare July 28, 2025 07:14

nixpkgs-ci bot removed the 2.status: merge conflict This PR has merge conflicts with the target branch label Jul 28, 2025

LordGrimmauld marked this pull request as ready for review July 28, 2025 07:34

LordGrimmauld requested review from leona-ya, marcin-serwin and a team July 28, 2025 07:35

nix-owners bot requested review from davidak, flokli, ElvishJerricco, aanderse and arianvp July 28, 2025 07:35

arianvp reviewed Jul 28, 2025

View reviewed changes

pkgs/by-name/li/linux-pam/package.nix Outdated Show resolved Hide resolved

arianvp reviewed Jul 28, 2025

View reviewed changes

pkgs/by-name/li/libeconf/package.nix Outdated Show resolved Hide resolved

LordGrimmauld force-pushed the linux-pam-1.7.1 branch 3 times, most recently from feb2692 to 494abac Compare July 28, 2025 10:15

arianvp reviewed Jul 28, 2025

View reviewed changes

SuperSandro2000 reviewed Jul 28, 2025

View reviewed changes

arianvp approved these changes Jul 28, 2025

View reviewed changes

nixpkgs-ci bot added 12.approvals: 1 This PR was reviewed and approved by one person. 12.approved-by: package-maintainer This PR was reviewed and approved by a maintainer listed in any of the changed packages. labels Jul 28, 2025

LordGrimmauld mentioned this pull request Jul 28, 2025

nixos/pam: replace deprecated lastlog with lastlog2 #429075

Open

LordGrimmauld force-pushed the linux-pam-1.7.1 branch from 494abac to f05ce3c Compare July 28, 2025 13:40

LordGrimmauld commented Jul 28, 2025

View reviewed changes

marcin-serwin suggested changes Jul 28, 2025

View reviewed changes

pkgs/by-name/kb/kbd/package.nix Outdated Show resolved Hide resolved

pkgs/by-name/li/linux-pam/package.nix Outdated Show resolved Hide resolved

LordGrimmauld force-pushed the linux-pam-1.7.1 branch 2 times, most recently from c6c2c99 to 4644447 Compare July 28, 2025 16:27

LordGrimmauld closed this Jul 28, 2025

LordGrimmauld reopened this Jul 28, 2025

arianvp reviewed Jul 28, 2025

View reviewed changes

pkgs/by-name/li/linux-pam/package.nix Outdated Show resolved Hide resolved

LordGrimmauld force-pushed the linux-pam-1.7.1 branch from 4644447 to cf9a7e8 Compare July 28, 2025 19:26

LordGrimmauld requested a review from K900 August 10, 2025 08:06

LordGrimmauld and others added 5 commits August 10, 2025 11:04

kbd: allow building without pam

7d9a26a

systemd: disable pam in transitive dependencies if pam is disabled

0ce91c7

systemd: Don't build nspawn for systemdLibs

0afdb39

linux-pam: 1.6.1 -> 1.7.1

26d61f3

PAM switched to meson build upstream, which requires some care: - build with logind support - reenable lastlog - clean up autotools remnants - disable debug as it slows down test making it fail

linux-pam: re-enable doc/man outputs

868e7c1

Co-Authored-by: Marcin Serwin <marcin@serwin.dev>

LordGrimmauld force-pushed the linux-pam-1.7.1 branch from cf9a7e8 to 868e7c1 Compare August 10, 2025 09:06

K900 merged commit 48a82c8 into NixOS:staging Aug 10, 2025
23 of 27 checks passed

vcunat mentioned this pull request Aug 10, 2025

systemdMinimal: fix build #432548

Merged

13 tasks

	kbd' = if withPam then kbd else kbd.override { withVlock = false; };
	kbd' = kbd.override { withVlock = !withPam; };

Uh oh!

linux-pam: 1.6.1 -> 1.7.1 #418255

linux-pam: 1.6.1 -> 1.7.1 #418255

Uh oh!

Conversation

LordGrimmauld commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Things done

Uh oh!

LordGrimmauld commented Jun 19, 2025

Uh oh!

marcin-serwin commented Jul 27, 2025

Uh oh!

LordGrimmauld commented Jul 27, 2025

Uh oh!

Uh oh!

Uh oh!

LordGrimmauld commented Jul 28, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SuperSandro2000 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LordGrimmauld commented Jul 28, 2025

Uh oh!

LordGrimmauld commented Jul 28, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nikstur Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

LordGrimmauld commented Jul 28, 2025

Uh oh!

LordGrimmauld commented Jul 28, 2025

Uh oh!

arianvp commented Jul 28, 2025

Uh oh!

Uh oh!

LordGrimmauld commented Jul 28, 2025

Uh oh!

Uh oh!

Uh oh!

LordGrimmauld commented Jun 19, 2025 •

edited

Loading

nikstur Jul 30, 2025 •

edited

Loading