anchor.diff:            ${optionalString (cfg.enableKwallet)
                 ("session optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" +
                  " kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}
  +          ${optionalString (cfg.enableGnomeKeyring)
  +              "session optional ${pkgs.gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so auto_start"}
             ${optionalString (config.virtualisation.lxc.lxcfs.enable)
                  "session optional ${pkgs.lxcfs}/lib/security/pam_cgfs.so -c freezer,memory,name=systemd,unified,cpuset"}
           '');
  
positive.code:           user's default KDE wallet upon login. If the user has no wallet named
            "kdewallet", or the login password does not match their wallet
            password, KDE will prompt separately after login.
          '';
        };
  
  
negative.code:           # prompts the user for password so we run it once with 'required' at an
            # earlier point and it will run again with 'sufficient' further down.
            # We use try_first_pass the second time to avoid prompting password twice
            (optionalString (cfg.unixAuth && (config.security.pam.enableEcryptfs || cfg.pamMount || cfg.enableKwallet || cfg.enableGnomeKeyring)) ''
                auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth
                ${optionalString config.security.pam.enableEcryptfs
                  "auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
  