anchor.diff:  
     options = {
   
  +    security.pam.loginLimits = mkOption {
  +      default = [];
  +      example =
  +        [ { domain = "ftp";
  +            type   = "hard";
  +            item   = "nproc";
  +            value  = "0";
  +          }
  +          { domain = "@student";
  +            type   = "-";
  +            item   = "maxlogins";
  +            value  = "4";
  +          }
  +       ];
  +
  +     description =
  +       '' Define resource limits that should apply to users or groups for the
  +          <command>login</command> service.  Each item in the list should be
  +          an attribute set with a <varname>domain</varname>,
  +          <varname>type</varname>, <varname>item</varname>, and
  +          <varname>value</varname> attribute.  The syntax and semantics of
  +          these attributes must be that described in the limits.conf(5) man
  +          page.
  +       '';
  +    };
  +
       security.pam.services = mkOption {
         default = [];
  -      example = [ { name = "chsh"; rootOK = true; } ];
  +      example = [
  +        { name = "chsh"; rootOK = true; }
  +        { name = "login"; ownDevices = true; allowNullPassword = true;
  +          limits = [
  +            { domain = "ftp";
  +              type   = "hard";
  +              item   = "nproc";
  +              value  = "0";
  +            }
  +          ];
  +        }
  +      ];
  +
         description =
           ''
             This option defines the PAM services.  A service typically
  
positive.code:               "session optional ${pkgs.consolekit}/lib/security/pam_ck_connector.so"}
            ${optionalString forwardXAuth
                "session optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99"}
          '';
        target = "pam.d/${name}";
      };
  
negative.code:           whether X authentication keys should be passed from the
            calling user to the target user (e.g. for
            <command>su</command>).
  
            The attribute <varname>limits</varname> defines resource limits
            that should apply to users or groups for the service.  Each item in
            the list should be an attribute set with a
            <varname>domain</varname>, <varname>type</varname>,
            <varname>item</varname>, and <varname>value</varname> attribute.
            The syntax and semantics of these attributes must be that described
            in the limits.conf(5) man page.
          '';
      };
  
  