nixos/containers: pam_lastlog2 breaks machinectl shell inside nspawn containers

[bubuntux]

Nixpkgs version

• Unstable (26.05)

Describe the bug

After updating to nixpkgs unstable, machinectl shell into declarative NixOS containers (containers.) connects and immediately disconnects without executing any commands. GUI applications launched via machinectl shell also silently fail.

Root cause: shadow.nix unconditionally sets security.pam.services.login.updateWtmp = true, which adds pam_lastlog2.so (util-linux 2.41) as a required module in the login PAM service. machinectl shell uses the login PAM service inside the container (via PAMName = "login" in the transient container-shell@.service unit). pam_lastlog2 fails silently inside nspawn containers, causing the PAM session to fail and the shell to exit immediately.

Steps to reproduce

1. Create a declarative NixOS container with a non-root user
2. Build and switch configuration
3. Start the container: machinectl start
4. Attempt to shell in: machinectl shell @
5. Observe: "Connected to machine... Connection terminated." with no shell or command execution

Expected behaviour

machinectl shell should open an interactive shell or execute the specified command inside the container.

Screenshots

No response

Relevant log output

Additional context

Workaround:

Inside the container config: security.pam.services.login.updateWtmp = lib.mkForce false;

Suggested fix:

Either:

• shadow.nix should use mkDefault for updateWtmp so containers can override without mkForce
• nixos-containers.nix should set security.pam.services.login.updateWtmp = false for declarative containers

System metadata

• system: "x86_64-linux"
• host os: Linux 6.18.18, NixOS, 26.05 (Yarara), 26.05.20260316.f8573b9
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.31.3
• nixpkgs: /nix/store/dgmmhy3y4chhi8w2vj87h7shfxv2adqn-source

Notify maintainers

---

Note for maintainers: Please tag this issue in your pull request description. (i.e. Resolves #ISSUE.)

I assert that this issue is relevant for Nixpkgs

• I assert that this is a bug and not a support request.
• I assert that this is not a duplicate of an existing issue.
• I assert that I have read the NixOS Code of Conduct and agree to abide by it.

Is this issue important to you?

Add a 👍 reaction to issues you find important.

[rharish101]

Sounds like #493934. The fix is in #495347, but it hasn't been merged to master yet, only to staging-next. Meanwhile, the upstream fix is in util-linux/util-linux@515b08c, but that hasn't been released either.