anchor.diff:          { name = "useradd"; rootOK = true; }
           # Used by groupadd etc.
           { name = "shadow"; rootOK = true; }
  -        { name = "login"; ownDevices = true; allowNullPassword = true; }
  +        { name = "login"; ownDevices = true; allowNullPassword = true;
  +          limits = config.security.pam.loginLimits;
  +        }
         ];
   
     };
  
positive.code:           whether X authentication keys should be passed from the
            calling user to the target user (e.g. for
            <command>su</command>).
          '';
      };
  
  
negative.code:       # accounts with hashed empty passwords are always allowed to log
        # in.
        allowNullPassword ? false
      , # The limits, as per limits.conf(5).
        limits ? []
      }:
  
      { source = pkgs.writeText "${name}.pam"
  