anchor.diff:                "session optional ${pkgs.consolekit}/lib/security/pam_ck_connector.so"}
             ${optionalString forwardXAuth
                 "session optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99"}
  +          ${optionalString (limits != [])
  +              "session required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf limits}"}
           '';
         target = "pam.d/${name}";
       };
  
positive.code: 
    options = {
  
      security.pam.services = mkOption {
        default = [];
        example = [ { name = "chsh"; rootOK = true; } ];
        description =
          ''
            This option defines the PAM services.  A service typically
  
negative.code:       session  required pam_warn.so
        session  required pam_deny.so
      '';
  
    # Create a limits.conf(5) file.
    makeLimitsConf = limits:
      pkgs.writeText "limits.conf"
        (concatStringsSep "\n"
             (map ({ domain, type, item, value }:
                   concatStringsSep " " [ domain type item value ])
                  limits));
  
    makePAMService =
      { name
  