security: enable core dumps and on-demand debug symbols

gnome-shell keeps segfaulting in libmutter, and with the PAM core
limit at 0 systemd-coredump threw every dump away, so there was no
backtrace to work from. Raise the limit to unlimited; dumps land
root-owned in /var/lib/systemd/coredump, readable only by their
owner. Enable nixseparatedebuginfod2 so gdb/coredumpctl can fetch
symbols for store paths on demand.

The user manager inherits the limit at its first login, so it takes
a reboot (or a full logout) to apply.

Assisted-by: Claude:opus-5

modules/security.nix

@@ -55,10 +55,15 @@
   # OpenSnitch Application Firewall
   services.opensnitch.enable = true;
 
+  # Core dumps enabled to debug gnome-shell/mutter segfaults; systemd-coredump
+  # stores them root-owned under /var/lib/systemd/coredump (ACL'd to the owner).
   security.pam.loginLimits = [
-    { domain = "*"; item = "core"; type = "-"; value = "0"; }
+    { domain = "*"; item = "core"; type = "-"; value = "unlimited"; }
   ];
 
+  # On-demand debug symbols for coredumpctl/gdb (sets DEBUGINFOD_URLS)
+  services.nixseparatedebuginfod2.enable = true;
+
   # Podman socket for all users
   systemd.user.sockets.podman.wantedBy = [ "sockets.target" ];
 

patches/mutter-touch-cancelled-grab.patch

@@ -0,0 +1,30 @@
+From: asxpi <asxpi@narayana.im>
+Subject: [PATCH] wayland/touch: Don't crash on grab requests for cancelled touches
+
+meta_wayland_touch_cancel() clears focus_surface on every active
+MetaWaylandTouchInfo but keeps the entries (and their slot_serial)
+until the touch ends. A client that sends xdg_toplevel.resize/move,
+an xdg_popup grab, start_drag or an activation request with the serial
+of such a touch makes meta_wayland_touch_find_grab_sequence() call
+touch_can_grab_surface(), which dereferences the NULL focus_surface:
+
+  #0 touch_can_grab_surface
+  #1 meta_wayland_touch_find_grab_sequence
+  #2 meta_wayland_seat_get_grab_info
+  #3 xdg_toplevel_resize
+
+A cancelled touch cannot grab anything; treat it as such.
+---
+--- a/src/wayland/meta-wayland-touch.c
++++ b/src/wayland/meta-wayland-touch.c
+@@ -656,6 +656,10 @@
+ {
+   MetaWaylandSurface *subsurface;
+ 
++  /* Cleared by meta_wayland_touch_cancel() while the touch is still down */
++  if (!touch_info->focus_surface)
++    return FALSE;
++
+   if (touch_info->focus_surface->surface == surface)
+     return TRUE;
+