I did not mean to close this. Apparently it got caught in my fork cleanup.

Can you explain this change in more detail? I don't quite understand it.

Looks good in principle, but I'm wondering why you set different default settings than what we have for the other sudo-rs pam services? Is there any reference for this?

Can you explain this change in more detail? I don't quite understand it.

My goal is to fix being able to run su -l, specifically in the context of entering an Incus instances.

𑁱 incus shell worker1
su: Authentication failed, try again.
su: Authentication failed, try again.
su: Maximum 3 incorrect authentication attempts

𑁱 incus alias list
+-------+----------------------+
| ALIAS |        TARGET        |
+-------+----------------------+
| shell | exec @ARGS@ -- su -l |
+-------+----------------------+

Which generates this error, indicating it's attempting to use the su-l service. This service isn't necessary for sudo, but apparently is for sudo-rs.

Aug 24 13:31:50 worker1 su[313036]: pam_warn(su-l:auth): function=[pam_sm_authenticate] flags=0x8001 service=[su-l] terminal=[/dev/pts/6] user=[root] ruser=[root] rhost=[<unknown>]

Looks good in principle, but I'm wondering why you set different default settings than what we have for the other sudo-rs pam services? Is there any reference for this?

I opted for these settings as they are the su settings in shadow.nix.