hallettj, 1 year ago (edited 8 months ago)

I did some digging around in the manual, and I tested this option which seems to work:

<span style="color:#323232;">security.pam.services.doas.fprintAuth = true;
</span>

On my machine that adds this line to /etc/pam.d/doas:

<span style="color:#323232;">auth sufficient /nix/store/fq4vbhdk8dqywxirg3wb99zidfss7sbi-fprintd-1.94.2/lib/security/pam_fprintd.so # fprintd (order 11400)
</span>

Edit: Note that the NixOS option puts in the full path to pam_fprintd.so. That’s necessary because NixOS doesn’t put so files in search paths.

Without doing more research I don’t know how to add arbitrary options to pam files in case you run into something that isn’t mapped to a NixOS option yet. The implementation for the pam options is here; there might be something in there that would work.