nixos/radicale: broken PAM auth plugin

[evyatark2]

Nixpkgs version

• Unstable (25.05)

Describe the bug

Radicale's PAM plugin is currently broken for several reasons:

• python3.pkgs.pam is not installed as a dependency
• The NixOS module doesn't install a new PAM module with the name radicale (although this might be the user's responsibility)
• When the user installs the radicale PAM module using security.pam with unixAuth = true , Radicale still can't verify user passwords because:
  1. pam_unix.so uses the setuid() syscall which is restricted because of SystemCallFilter=[ ... "~@privileged" ... ]
  2. The process can't access /etc/shadow due to insufficient privileges (Can be fixed by using SupplementaryGroups=["shadow"]; (see the comment in https://github.com/Kozea/Radicale/blob/master/radicale/auth/pam.py)

Of course, changing these the way I proposed could be a security issue that I am not entirely familiar with. I just listed the things I did to make it work.

Steps to reproduce

Use services.radicale.auth.type = "pam"

Expected behaviour

See above

Screenshots

No response

Relevant log output

Additional context

No response

System metadata

• system: "x86_64-linux"
• host os: Linux 6.12.21, NixOS, 25.05 (Warbler), 25.05pre776537.52faf482a388
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.24.13
• channels(root): "nixos"
• nixpkgs: /nix/var/nix/profiles/per-user/root/channels/nixos

Notify maintainers

@dotlambda

---

Note for maintainers: Please tag this issue in your pull request description. (i.e. Resolves #ISSUE.)

I assert that this issue is relevant for Nixpkgs

• I assert that this is a bug and not a support request.
• I assert that this is not a duplicate of an existing issue.
• I assert that I have read the NixOS Code of Conduct and agree to abide by it.

Is this issue important to you?

Add a 👍 reaction to issues you find important.

[evyatark2]

I can go ahead and implement this, I just need guidance on how to design the feature.

My idea is to introduce a usePAM option in the module that does all of my proposed ideas in the OP including pulling a dependency to python3.pkgs.pam meaning the default pkgs.radicale package will have PAM disabled by default.

Also if anyone has any objections to point (3) due to security considerations please let me know and if there is a better way to do it.

[Derpitron]

Can you post workarounds/your full proposed solution for each of the bugs you listed?