security.pam.enableSudoTouchIdAuth can no longer be used

Help
1

I’m doing a nix flake update and when I try to build I get this error

       … while calling the 'derivationStrict' builtin

         at /builtin/derivation.nix:9:12: (source not available)

       … while evaluating derivation 'darwin-system-25.05.adf5c88'
         whose name attribute is located at /nix/store/8rv7qar60c9p7hzwfa02syvl4yzrgmsm-source/pkgs/stdenv/generic/make-derivation.nix:375:7

       … while evaluating attribute 'activationScript' of derivation 'darwin-system-25.05.adf5c88'

         at /nix/store/ndx3c38gkfbrgcjz8w0czyw9a1d93ijk-source/modules/system/default.nix:97:7:

           96|
           97|       activationScript = cfg.activationScripts.script.text;
             |       ^
           98|       activationUserScript = cfg.activationScripts.userScript.text;

       (stack trace truncated; use '--show-trace' to show the full trace)

       error: The option `security.pam.enableSudoTouchIdAuth' can no longer be used since it's been removed. This option has been renamed to `security.pam.services.sudo_local.touchIdAuth` for consistency with NixOS.

In my flake.nix I have

 option = "security.pam.enableSudoTouchIdAuth";

but updating that line doesn’t resolve.

What do I need to do?

My setup is here GitHub - philcruz/nixconfig-public

2

As mentioned in the error message, the new option is called security.pam.services.sudo_local.touchIdAuth

3

Thanks. But as I mentioned I updated to

          let
            file   = "/etc/pam.d/sudo";
            option = "security.pam.services.sudo_local.touchIdAuth";

and I still get the error. What am I missing?

4

Here’s the full output if that helps

image
image1988×840 112 KB

5

The line you changed there is just for leaving a comment in the generated file. This line is the one that’s actually reading the option:

So that’s what you need to fix.

6

That’s a string, a string is not an option. The problem line is mentioned above.

7

Thanks for clarifying the problematic line.

Could you tell me what I need to change to fix it?

I set up nix-darwin because I wanted to get away from managing 3 different machines manually. While I got it to work, I never have been able to really understand how it works and how to troubleshoot. I really want to but can’t seem to find docs that I can understand.

Every few months I go to do an update and I find myself down a rabbit hole when I just want to get on with other stuff.

Anyway, I appreciate the help so far but if you can tell me what I need to change that would be great. Even better if you can help me understand how to troubleshoot things better.

8

Change the line

cfg = config.security.pam;

to

cfg = config.security.pam.services.sudo_local;.

and

the line

${mkSudoTouchIdAuthScript cfg.enableSudoTouchIdAuth}

to

${mkSudoTouchIdAuthScript cfg.touchIdAuth}.

That should do the trick. I don’t know why you wrote it in separate lines because you don’t seem to use cfg anywhere else but I leave that up to you.

1 Like
9

Thanks!

That did the trick.

I don’t know why you wrote it in separate lines because you don’t seem to use cfg anywhere else

I did it that way because I just copied that set up from here.

10

You should remove all of this. The upstream PR it is excerpted from was merged 2½ years ago, and the functionality has since been adjusted further.

I strongly recommend against pasting module/system activation code into your configuration without understanding them. Following outdated guides is a good way to end up with really confusing errors.

Edit:

It looks like you don’t even include security-pam in your configuration. So you can just remove all of that and then replace the option with the new one where you actually set it.

IIRC the nix-index module is also unnecessary as there is a module upstream in nix-index already.

2 Likes
11

@emily Thanks.

Yeah, I started using nix 2 years ago. I came across articles like Tutorial: Getting started with Home Manager for Nix | Mattia Gheda which gave enough example code to get things working.

I didn’t really understand but figured “just get it working and you can learn the details over time”. Unfortunately, learning the details over time has not happened but not due to lack of desire. I really want to learn/understand but haven’t yet been pointed to or found resources that help me move forward. (Flake vs not to flake is confusing for newbies as well.)

When I hit issues, people are super helpful, but they generally say "just do X " to fix it without giving all the background. Which is totally fine, I appreciate any help and there is no obligation to help me further.

Not sure why I have a hard time with Nix. I’m a software engineer, deal with package managers, AWS, DevOps, and such.

But if someone can point me to The Way that would be great…

12

Relying on blog posts from years ago will get you in trouble, nixpkgs changes too quickly for most of those things to be valid. Just get used to searching in https://search.nixos.org/options and possibly going through module code to see if your usecase is already covered by an option.

1 Like
13

Don’t worry you will get there. I’m a Mechanical Engineer and got there so you should be able to do it as well :wink:.

As @waffle8946 already wrote the key thing is reading code, a lot of code. Once I started looking at the implementation of the modules it clicked for me. And you get a feeling on how things are done.

1 Like