anchor.diff:            whether X authentication keys should be passed from the
             calling user to the target user (e.g. for
             <command>su</command>).
  +
  +          The attribute <varname>limits</varname> defines resource limits
  +          that should apply to users or groups for the service.  Each item in
  +          the list should be an attribute set with a
  +          <varname>domain</varname>, <varname>type</varname>,
  +          <varname>item</varname>, and <varname>value</varname> attribute.
  +          The syntax and semantics of these attributes must be that described
  +          in the limits.conf(5) man page.
           '';
       };
   
  
positive.code: 
    options = {
  
      security.pam.services = mkOption {
        default = [];
        example = [ { name = "chsh"; rootOK = true; } ];
        description =
          ''
            This option defines the PAM services.  A service typically
  
negative.code:         { name = "useradd"; rootOK = true; }
          # Used by groupadd etc.
          { name = "shadow"; rootOK = true; }
          { name = "login"; ownDevices = true; allowNullPassword = true;
            limits = config.security.pam.loginLimits;
          }
        ];
  
    };
  