NOTE: Current WIP, and needs real testing. This is just to get review input/make sure it doesn't get lost.

Modifying pam causes a chain that implies a heavy rebuild for nixos-rebuild, so punting this to staging.

Motivation for this change

I would like to start headless machines services such as Nginx that can direct logged in users to access them through their IP address or domain name.

In order to do this, I need to run a script dynamically, and I would like PAM to output this as part of the MOTD upon running login or the user SSH'ing in -- e.g. by running ifconfig or ip. But in order to do this, I must dynamically run a script which will perform some action (for example, cat a file, run ifconfig, or even wait for a systemd service to start and check something).

This patchset adds support to the pam package and pam NixOS module to allow the config.users.motd option to represent a dynamic script to be run.

The original patchset is heavily based on the original patchset adding this feature, which is not available upstream, courtesy of the Debian/Ubuntu maintainers (I took this from the Ubuntu Launchpad package). This patchset executes a single script named /etc/update-motd, which outputs to /run/motd.dynamic, which is then read by the module after execution.

This patchset is not exactly the same as the original patchset. In particular, the original one runs a set of scripts using run-parts. However, this is based on LSB-style ordering which doesn't easily apply here; furthermore it's expected dynamic MOTDs are 'globally managed' and ordered, but this doesn't feel right with NixOS modules (e.g. if I import a module, does its dynamic script run first or second?) Second, MOTDs are something best set by the user anyway, so it's probably best to just have a single option for the whole machine.

An alternative to this is to just turn off pam_motd and execute the script as part of /etc/profile or something (which is what happens on Fedora I believe) and have it executed on every shell but this feels hackier and I'm not sure the semantics are precisely the same.

Some things to note:

• This currently overloads config.users.motd to be either plain text or a script, but that doesn't feel right. Should this change to another option (config.users.motd.script?) with some asserts concerning usage?
• The documentation needs to be fixed.
• The man page patch should be changed to point to the NixOS manual, perhaps? Or a new man page. With a small blurb about the semantics of this (see update-motd(5) in Ubuntu)
• This is untested but I wanted to get it online for review.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions (Fedora 25 with sandboxing)
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.