nixos: Set mmap ASLR entropy to a safe default on AArch64 (#513672)

2026-04-26 12:15:29 +00:00
parent bc33d9febb 80109f6539
commit 074d5dc7ea
1 changed files with 4 additions and 12 deletions
@@ -96,18 +96,10 @@ in
      # Maximise address space randomisation.
      "vm.mmap_rnd_bits" = lib.mkMerge [
        (lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (
-          let
-            kernel = config.boot.kernelPackages.kernel;
-            isYes = kernel.config.isYes or (_: false);
-          in
-          lib.mkDefault (
-            if isYes "ARM64_64K_PAGES" then
-              29
-            else if isYes "ARM64_16K_PAGES" then
-              31
-            else
-              33
-          )
+          # Ideally, we'd want to set this to 33 on 4K pagesize
+          # kernels, but some vendor kernels e.g. linux_rpi can
+          # do a maximum of 24.
+          lib.mkDefault 24
        ))
        (lib.mkIf pkgs.stdenv.hostPlatform.isx86_64 (lib.mkDefault 32))
      ];