gradm: fix gradm_pam path

We alredy rewrote /sbin/gradm, which technically matches
/sbin/gradm_pam, so this ends up working exactly as we want. Otherwise
we rewrite twice and gradm can't execute the PAM module with '-p'

Signed-off-by: Austin Seipp <aseipp@pobox.com>
gradm: learn of all accesses for /nix/store

This is necessary for gradm's learning mode to work, as otherwise the
/nix/store directory is marked hidden, which causes the kernel to reject
the linker loading ld-linux.so

Signed-off-by: Austin Seipp <aseipp@pobox.com>
nixos: make several kernel common-config options optional

Realistically, common-config is useful, but there are a lot of things in
there that are non-optionally specified that aren't always useful. For
example, when deploying grsecurity, I don't want the bluetooth,
wireless, or input joystick/extra filesystem stack (XFS, etc), nor the
staging drivers tree.

The problem is that if you specify this in your own kernel config in the
grsecurity module, by saying 'BT n' to turn off bluetooth,
common-config turns on 'BT_HCIUART_BCSP y', which then becomes unused
and errors out.

This is really just an arbitrary picking at the moment, but it should be
OK.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
grsecurity: improvements, round 2

  - Abstract patches in the linux package - now easily specified with
    kernel version, revision, and SHA-256.
  - Add vserver support and an option for the stable kernel to enable
    it.
  - Make it possible to enable the 'verbose' version string which will
    appear in 'uname -a'. This is off by default (it does confer some
    information to an attacker theoretically), but it's useful at a
    glance while developing, or reporting bugs.
  - Add a new grsec-lock service, which runs after sysctl to set
    grsec_lock = 1. Users can use boot.kernel.sysctl to set
    "kernel.grsecurity" options at their whim and reboot for them to
    take affect. This service is only installed if
    `grsecurity.config.sysctl = true`

    I toyed with the idea of making this optional, but it's pretty easy
    to forget. Perhaps there should be an option to disable auto-running
    of the service during 'development'

Signed-off-by: Austin Seipp <aseipp@pobox.com>
grsecurity: fix restrictLinks/randstruct

Now, we only say RANDSTRUCT n or GRKERNSEC_LINKS n when the user has an
incompatible configuration (vbox guest, or testing kernel respectively).
Otherwise we specify nothing and let the default configuration (or user)
choose.

Signed-off-by: Austin Seipp <aseipp@pobox.com>