From b5dad466d5009c9c6f33538451cd3fbe4e612a3e Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Sat, 14 May 2016 14:01:49 +0100
Subject: [PATCH 01/11] dash: add shellPath passthru

---
 pkgs/shells/dash/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/shells/dash/default.nix b/pkgs/shells/dash/default.nix
index d3104439e57..1a95b4f42e6 100644
--- a/pkgs/shells/dash/default.nix
+++ b/pkgs/shells/dash/default.nix
@@ -13,4 +13,8 @@ stdenv.mkDerivation rec {
     description = "A POSIX-compliant implementation of /bin/sh that aims to be as small as possible";
     hydraPlatforms = stdenv.lib.platforms.linux;
   };
+
+  passthru = {
+    shellPath = "/bin/dash";
+  };
 }

From 68865f51ef5c8d7194ecfdc0c673a1db665f4877 Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Sat, 14 May 2016 14:02:24 +0100
Subject: [PATCH 02/11] es: add shellPath passthru

---
 pkgs/shells/es/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/shells/es/default.nix b/pkgs/shells/es/default.nix
index ba9fe29c33e..037d1e1ec99 100644
--- a/pkgs/shells/es/default.nix
+++ b/pkgs/shells/es/default.nix
@@ -43,4 +43,8 @@ stdenv.mkDerivation {
     maintainers = [ maintainers.sjmackenzie ];
     platforms = platforms.all;
   };
+
+  passthru = {
+    shellPath = "/bin/es";
+  };
 }

From b482036cbb61083e6e06a77dabfb14c2279be13d Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Sat, 14 May 2016 14:02:37 +0100
Subject: [PATCH 03/11] fish: add shellPath passthru

---
 pkgs/shells/fish/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 0124f914866..353647f15b3 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -87,4 +87,8 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     maintainers = with maintainers; [ ocharles ];
   };
+
+  passthru = {
+    shellPath = "/bin/fish";
+  };
 }

From 7fcd50da4f72cdd73a05e6a613685a92a568ecec Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Sat, 14 May 2016 14:02:52 +0100
Subject: [PATCH 04/11] mksh: add shellPath passthru

---
 pkgs/shells/mksh/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/shells/mksh/default.nix b/pkgs/shells/mksh/default.nix
index 696777c7f1f..dde890a022d 100644
--- a/pkgs/shells/mksh/default.nix
+++ b/pkgs/shells/mksh/default.nix
@@ -43,4 +43,8 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ AndersonTorres nckx ];
     platforms = platforms.unix;
   };
+
+  passthru = {
+    shellPath = "/bin/mksh";
+  };
 }

From 27ef2eb695c712a0b6e054f789c4f27f915b9055 Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Sat, 14 May 2016 14:03:01 +0100
Subject: [PATCH 05/11] pash: add shellPath passthru

---
 pkgs/shells/pash/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/shells/pash/default.nix b/pkgs/shells/pash/default.nix
index b9a8397e3ba..0b424c89777 100644
--- a/pkgs/shells/pash/default.nix
+++ b/pkgs/shells/pash/default.nix
@@ -22,4 +22,8 @@ buildDotnetPackage rec {
     platforms = platforms.all;
     license = with licenses; [ bsd3 gpl3 ];
   };
+
+  passthru = {
+    shellPath = "/bin/pash";
+  };
 }

From 2e22de1f58c8d796867bda0c5831c9cb5d2d04eb Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Sat, 14 May 2016 14:03:13 +0100
Subject: [PATCH 06/11] rush: add shellPath passthru

---
 pkgs/shells/rush/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/shells/rush/default.nix b/pkgs/shells/rush/default.nix
index 3232caf5848..bbad1f8cdf4 100644
--- a/pkgs/shells/rush/default.nix
+++ b/pkgs/shells/rush/default.nix
@@ -35,4 +35,8 @@ stdenv.mkDerivation rec {
     maintainers = [ stdenv.lib.maintainers.bjg ];
     platforms = stdenv.lib.platforms.all;
   };
+
+  passthru = {
+    shellPath = "/bin/rush";
+  };
 }

From 53060e5bb8b0bbf73aeda1383fac73c9c8122e55 Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Sat, 14 May 2016 14:03:25 +0100
Subject: [PATCH 07/11] tcsh: add shellPath passthru

---
 pkgs/shells/tcsh/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/shells/tcsh/default.nix b/pkgs/shells/tcsh/default.nix
index be182f87f1e..764ea64f3ce 100644
--- a/pkgs/shells/tcsh/default.nix
+++ b/pkgs/shells/tcsh/default.nix
@@ -19,4 +19,8 @@ stdenv.mkDerivation rec {
     homepage = http://www.tcsh.org/;
     description = "An enhanced version of the Berkeley UNIX C shell (csh)";
   };
+
+  passthru = {
+    shellPath = "/bin/tcsh";
+  };
 }

From a9f42f633bce4e2f3637287031c41c910eab3a0c Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Sat, 14 May 2016 14:03:37 +0100
Subject: [PATCH 08/11] xonsh: add shellPath passthru

---
 pkgs/shells/xonsh/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/shells/xonsh/default.nix b/pkgs/shells/xonsh/default.nix
index 395132bc2d8..78edf83caf7 100644
--- a/pkgs/shells/xonsh/default.nix
+++ b/pkgs/shells/xonsh/default.nix
@@ -41,4 +41,8 @@ python3Packages.buildPythonApplication rec {
     maintainers = with maintainers; [ spwhitt garbas ];
     platforms = platforms.all;
   };
+
+  passthru = {
+    shellPath = "/bin/xonsh";
+  };
 }

From 7e578dc334dbb6af87f2b194bd0ed91d75956973 Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Sat, 14 May 2016 14:03:47 +0100
Subject: [PATCH 09/11] zsh: add shellPath passthru

---
 pkgs/shells/zsh/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/shells/zsh/default.nix b/pkgs/shells/zsh/default.nix
index fda3e77c61f..261dbf12f8e 100644
--- a/pkgs/shells/zsh/default.nix
+++ b/pkgs/shells/zsh/default.nix
@@ -80,4 +80,8 @@ EOF
     maintainers = with stdenv.lib.maintainers; [ chaoflow pSub ];
     platforms = stdenv.lib.platforms.unix;
   };
+
+  passthru = {
+    shellPath = "/bin/zsh";
+  };
 }

From e2413ad5a8b6a80e5552306518fdf16e68b6c6d7 Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Sun, 12 Jun 2016 20:12:51 +0100
Subject: [PATCH 10/11] shadow: add shellPath passthru

This one is a bit special, it's used to deny users from logging in.
---
 pkgs/os-specific/linux/shadow/default.nix | 3 +++
 pkgs/top-level/all-packages.nix           | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index 321e94e3aaf..7f0d40f6be1 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -53,5 +53,8 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = http://pkg-shadow.alioth.debian.org/;
     description = "Suite containing authentication-related tools such as passwd and su";
+    passthru = {
+      shellPath = "/bin/nologin";
+    };
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3331f6d6b03..7c4cb7bb4f4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2233,6 +2233,9 @@ in
   else
     nodePackages_4_x;
 
+  # Can be used as a user shell
+  nologin = shadow;
+
   npm2nix = nodePackages.npm2nix;
 
   ldapvi = callPackage ../tools/misc/ldapvi { };

From 2974b6f4c8224ab1097e9386d6b3a0d570f95531 Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Sun, 12 Jun 2016 20:03:14 +0100
Subject: [PATCH 11/11] Use shell packages to select the user's shell

The string type is still available for backward-compatiblity.
---
 lib/types.nix                               |  4 ++++
 nixos/lib/utils.nix                         |  6 +++++
 nixos/modules/config/shells-environment.nix |  8 +++----
 nixos/modules/config/users-groups.nix       | 25 +++++++++++++++------
 nixos/modules/programs/bash/bash.nix        |  2 +-
 nixos/modules/programs/shadow.nix           | 18 ++++++++-------
 6 files changed, 43 insertions(+), 20 deletions(-)

diff --git a/lib/types.nix b/lib/types.nix
index 91b39f3a9cf..83f624e6b44 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -100,6 +100,10 @@ rec {
         in if isDerivation res then res else toDerivation res;
     };
 
+    shellPackage = package // {
+      check = x: (package.check x) && (hasAttr "shellPath" x);
+    };
+
     path = mkOptionType {
       name = "path";
       # Hacky: there is no ‘isPath’ primop.
diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix
index 7b8be2050c1..871fbb121d0 100644
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@@ -8,4 +8,10 @@ rec {
    replaceChars ["/" "-" " "] ["-" "\\x2d" "\\x20"]
     (if hasPrefix "/" s then substring 1 (stringLength s) s else s);
 
+  # Returns a system path for a given shell package
+  toShellPath = shell:
+    if types.shellPackage.check shell then
+      "/run/current-system/sw${shell.shellPath}"
+    else
+      shell;
 }
diff --git a/nixos/modules/config/shells-environment.nix b/nixos/modules/config/shells-environment.nix
index 9642981803b..f458bc39ada 100644
--- a/nixos/modules/config/shells-environment.nix
+++ b/nixos/modules/config/shells-environment.nix
@@ -1,7 +1,7 @@
 # This module defines a global environment configuration and
 # a common configuration for all shells.
 
-{ config, lib, pkgs, ... }:
+{ config, lib, utils, pkgs, ... }:
 
 with lib;
 
@@ -135,13 +135,13 @@ in
 
     environment.shells = mkOption {
       default = [];
-      example = [ "/run/current-system/sw/bin/zsh" ];
+      example = literalExample "[ pkgs.bashInteractive pkgs.zsh ]";
       description = ''
         A list of permissible login shells for user accounts.
         No need to mention <literal>/bin/sh</literal>
         here, it is placed into this list implicitly.
       '';
-      type = types.listOf types.path;
+      type = types.listOf (types.either types.shellPackage types.path);
     };
 
   };
@@ -158,7 +158,7 @@ in
 
     environment.etc."shells".text =
       ''
-        ${concatStringsSep "\n" cfg.shells}
+        ${concatStringsSep "\n" (map utils.toShellPath cfg.shells)}
         /bin/sh
       '';
 
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index e643b2d059b..95b3e3ca185 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -1,9 +1,8 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, utils, pkgs, ... }:
 
 with lib;
 
 let
-
   ids = config.ids;
   cfg = config.users;
 
@@ -103,7 +102,7 @@ let
       };
 
       home = mkOption {
-        type = types.str;
+        type = types.path;
         default = "/var/empty";
         description = "The user's home directory.";
       };
@@ -118,8 +117,10 @@ let
       };
 
       shell = mkOption {
-        type = types.str;
-        default = "/run/current-system/sw/bin/nologin";
+        type = types.either types.shellPackage types.path;
+        default = pkgs.nologin;
+        defaultText = "pkgs.nologin";
+        example = literalExample "pkgs.bashInteractive";
         description = "The path to the user's shell.";
       };
 
@@ -359,11 +360,12 @@ let
 
   spec = pkgs.writeText "users-groups.json" (builtins.toJSON {
     inherit (cfg) mutableUsers;
-    users = mapAttrsToList (n: u:
+    users = mapAttrsToList (_: u:
       { inherit (u)
-          name uid group description home shell createHome isSystemUser
+          name uid group description home createHome isSystemUser
           password passwordFile hashedPassword
           initialPassword initialHashedPassword;
+        shell = utils.toShellPath u.shell;
       }) cfg.users;
     groups = mapAttrsToList (n: g:
       { inherit (g) name gid;
@@ -373,6 +375,12 @@ let
       }) cfg.groups;
   });
 
+  systemShells =
+    let
+      shells = mapAttrsToList (_: u: u.shell) cfg.users;
+    in
+      filter types.shellPackage.check shells;
+
 in {
 
   ###### interface
@@ -478,6 +486,9 @@ in {
       };
     };
 
+    # Install all the user shells
+    environment.systemPackages = systemShells;
+
     users.groups = {
       root.gid = ids.gids.root;
       wheel.gid = ids.gids.wheel;
diff --git a/nixos/modules/programs/bash/bash.nix b/nixos/modules/programs/bash/bash.nix
index e4e264ec003..c09bcfb70e2 100644
--- a/nixos/modules/programs/bash/bash.nix
+++ b/nixos/modules/programs/bash/bash.nix
@@ -200,7 +200,7 @@ in
     # Configuration for readline in bash.
     environment.etc."inputrc".source = ./inputrc;
 
-    users.defaultUserShell = mkDefault "/run/current-system/sw/bin/bash";
+    users.defaultUserShell = mkDefault pkgs.bashInteractive;
 
     environment.pathsToLink = optionals cfg.enableCompletion [
       "/etc/bash_completion.d"
diff --git a/nixos/modules/programs/shadow.nix b/nixos/modules/programs/shadow.nix
index 566398d839f..6398509357a 100644
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@@ -1,6 +1,6 @@
 # Configuration for the pwdutils suite of tools: passwd, useradd, etc.
 
-{ config, lib, pkgs, ... }:
+{ config, lib, utils, pkgs, ... }:
 
 with lib;
 
@@ -43,13 +43,13 @@ in
     users.defaultUserShell = lib.mkOption {
       description = ''
         This option defines the default shell assigned to user
-        accounts.  This must not be a store path, since the path is
+        accounts. This can be either a full system path or a shell package.
+
+        This must not be a store path, since the path is
         used outside the store (in particular in /etc/passwd).
-        Rather, it should be the path of a symlink that points to the
-        actual shell in the Nix store.
       '';
-      example = "/run/current-system/sw/bin/zsh";
-      type = types.path;
+      example = literalExample "pkgs.zsh";
+      type = types.either types.path types.shellPackage;
     };
 
   };
@@ -60,7 +60,9 @@ in
   config = {
 
     environment.systemPackages =
-      lib.optional config.users.mutableUsers pkgs.shadow;
+      lib.optional config.users.mutableUsers pkgs.shadow ++
+      lib.optional (types.shellPackage.check config.users.defaultUserShell)
+        config.users.defaultUserShell;
 
     environment.etc =
       [ { # /etc/login.defs: global configuration for pwdutils.  You
@@ -74,7 +76,7 @@ in
             ''
               GROUP=100
               HOME=/home
-              SHELL=${config.users.defaultUserShell}
+              SHELL=${utils.toShellPath config.users.defaultUserShell}
             '';
           target = "default/useradd";
         }