anchor.diff:        session  required pam_warn.so
         session  required pam_deny.so
       '';
  +
  +  # Create a limits.conf(5) file.
  +  makeLimitsConf = limits:
  +    pkgs.writeText "limits.conf"
  +      (concatStringsSep "\n"
  +           (map ({ domain, type, item, value }:
  +                 concatStringsSep " " [ domain type item value ])
  +                limits));
   
     makePAMService =
       { name
  
positive.code:       # accounts with hashed empty passwords are always allowed to log
        # in.
        allowNullPassword ? false
      }:
  
      { source = pkgs.writeText "${name}.pam"
  
negative.code:           whether X authentication keys should be passed from the
            calling user to the target user (e.g. for
            <command>su</command>).
  
            The attribute <varname>limits</varname> defines resource limits
            that should apply to users or groups for the service.  Each item in
            the list should be an attribute set with a
            <varname>domain</varname>, <varname>type</varname>,
            <varname>item</varname>, and <varname>value</varname> attribute.
            The syntax and semantics of these attributes must be that described
            in the limits.conf(5) man page.
          '';
      };
  
  