Change:
GDM currently uses custom PAM configuration that doesn't cover all items that are generated when is used, especially for sessions. As a result, logging in via GDM doesn't apply custom limits set via . custom limits that apply to the current user via out and back in again (via GDM) output output again, compare System: 16.09.1066. (Flounder) Nix version: nix-env (Nix) 1.11.4 Nixpkgs version: 16.09.1066.
Also facing this issue.
Closing in favor of open PR.

Discussion:
"password sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass"} ${optionalString config.services.samba.syncPasswordsByPam "password optional ${pkgs.samba}/lib/security/pam_smbpass.so nullok use_authtok try_first_pass"} <ins> ${optionalString cfg.enableGnomeKeyring "password optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok"} </ins> # Session management. ${optionalString cfg.setEnvironment ''

services.dbus.packages = [ pkgs.gnome3.gnome-keyring pkgs.gcr ]; <ins> security.pam.services.login.enableGnomeKeyring = true; </ins> }; }

session  optional       pam_permit.so ''; <del> gdm.text = '' auth     requisite      pam_nologin.so auth     required       pam_env.so envfile=${config.system.build.pamEnvironment} auth     required       pam_succeed_if.so uid >= 1000 quiet auth     optional       ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auth     ${if config.security.pam.enableEcryptfs then "required" else "sufficient"} pam_unix.so nullok likeauth ${optionalString config.security.pam.enableEcryptfs "auth required ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"} ${optionalString (! config.security.pam.enableEcryptfs) "auth     required       pam_deny.so"} account  sufficient     pam_unix.so password requisite      pam_unix.so nullok sha512 ${optionalString config.security.pam.enableEcryptfs "password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"} session  required       pam_env.so envfile=${config.system.build.pamEnvironment} session  required       pam_unix.so ${optionalString config.security.pam.enableEcryptfs "session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"} session  required       pam_loginuid.so session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so session  optional       ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start ''; </del> gdm-password.text = '' <del> auth     requisite      pam_nologin.so auth     required       pam_env.so envfile=${config.system.build.pamEnvironment} auth     required       pam_succeed_if.so uid >= 1000 quiet auth     optional       ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auth     ${if config.security.pam.enableEcryptfs then "required" else "sufficient"} pam_unix.so nullok likeauth ${optionalString config.security.pam.enableEcryptfs "auth required ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"} ${optionalString (! config.security.pam.enableEcryptfs) "auth     required       pam_deny.so"} account  sufficient     pam_unix.so password requisite      pam_unix.so nullok sha512 ${optionalString config.security.pam.enableEcryptfs "password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"} session  required       pam_env.so envfile=${config.system.build.pamEnvironment} session  required       pam_unix.so ${optionalString config.security.pam.enableEcryptfs "session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so"} session  required       pam_loginuid.so session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so session  optional       ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start </del> <ins> auth      substack      login account   include       login password  substack      login session   include       login </ins> ''; gdm-autologin.text = '' <del> auth     requisite      pam_nologin.so </del> <ins> auth      requisite     pam_nologin.so </ins> <del> auth     required       pam_succeed_if.so uid >= 1000 quiet auth     required       pam_permit.so </del> <ins> auth      required      pam_succeed_if.so uid >= 1000 quiet auth      required      pam_permit.so </ins> <del> account  sufficient     pam_unix.so </del> <ins> account   sufficient    pam_unix.so </ins> <del> password requisite      pam_unix.so nullok sha512 </del> <ins> password  requisite     pam_unix.so nullok sha512 </ins> <del> session  optional       pam_keyinit.so revoke session  required       pam_env.so envfile=${config.system.build.pamEnvironment} session  required       pam_unix.so session  required       pam_loginuid.so session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so </del> <ins> session   optional      pam_keyinit.so revoke session   include       login </ins> ''; };