NixOS/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions 7 Packages Projects Releases Wiki Activity

nixos: Set mmap ASLR entropy dynamically (#513771)

Browse Source
This commit is contained in:
Florian Klink
2026-04-28 20:44:36 +00:00
committed by GitHub
parent b6874459dd 89f2772cfb
commit 2f78b6d723
1 changed files with 26 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/config/sysctl.nix
+26 -19
View File
@@ -66,11 +66,32 @@ in
config = {
environment.etc."sysctl.d/60-nixos.conf".text = lib.concatStrings (
lib.mapAttrsToList (
n: v: lib.optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n"
) config.boot.kernel.sysctl
);
environment.etc = {
"sysctl.d/55-nixos-aslr-entropy.conf".source =
pkgs.runCommand "55-nixos-aslr-entropy.conf"
{
inherit (config.boot.kernelPackages.kernel) configfile;
}
''
mmap_rnd_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$")
if [[ -z "$mmap_rnd_bits_max" ]]; then
echo "Unable to determine mmap_rnd_bits_max. Check your kernel configfile is valid."
exit 1
fi
mmap_rnd_compat_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$")
if [[ -z "$mmap_rnd_compat_bits_max" ]]; then
echo "Unable to determine mmap_rnd_compat_bits_max. Check your kernel configfile is valid."
exit 1
fi
echo "vm.mmap_rnd_bits=$mmap_rnd_bits_max" >> $out
echo "vm.mmap_rnd_compat_bits=$mmap_rnd_compat_bits_max" >> $out
'';
"sysctl.d/60-nixos.conf".text = lib.concatStrings (
lib.mapAttrsToList (
n: v: lib.optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n"
) config.boot.kernel.sysctl
);
};
systemd.services.systemd-sysctl = {
wantedBy = [ "multi-user.target" ];
@@ -92,20 +113,6 @@ in
# the value below is used by default on several other distros.
"fs.inotify.max_user_instances" = lib.mkDefault 524288;
"fs.inotify.max_user_watches" = lib.mkDefault 524288;
# Maximise address space randomisation.
"vm.mmap_rnd_bits" = lib.mkMerge [
(lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (
# Ideally, we'd want to set this to 33 on 4K pagesize
# kernels, but some vendor kernels e.g. linux_rpi can
# do a maximum of 24.
lib.mkDefault 24
))
(lib.mkIf pkgs.stdenv.hostPlatform.isx86_64 (lib.mkDefault 32))
];
"vm.mmap_rnd_compat_bits" = lib.mkIf (
pkgs.stdenv.hostPlatform.isx86_64 || pkgs.stdenv.hostPlatform.isAarch64
) (lib.mkDefault 16);
};
};
}