anchor.diff:        session  required pam_warn.so
         session  required pam_deny.so
       '';
  +
  +  # Create a limits.conf(5) file.
  +  makeLimitsConf = limits:
  +    pkgs.writeText "limits.conf"
  +      (concatStringsSep "\n"
  +           (map ({ domain, type, item, value }:
  +                 concatStringsSep " " [ domain type item value ])
  +                limits));
   
     makePAMService =
       { name
  
positive.code:               "session optional ${pkgs.consolekit}/lib/security/pam_ck_connector.so"}
            ${optionalString forwardXAuth
                "session optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99"}
          '';
        target = "pam.d/${name}";
      };
  
negative.code:       # accounts with hashed empty passwords are always allowed to log
        # in.
        allowNullPassword ? false
      , # The limits, as per limits.conf(5).
        limits ? []
      }:
  
      { source = pkgs.writeText "${name}.pam"
  