From 80109f6539fb83aac79d09b1fece9da482cc26de Mon Sep 17 00:00:00 2001
From: Yureka <yureka@cyberchaos.dev>
Date: Sun, 26 Apr 2026 13:10:12 +0200
Subject: [PATCH] nixos: Set mmap ASLR entropy to a safe default on AArch64

The eval-time access to kernel config is not enabled for any nixpkgs-packaged
kernels by default since it requires IFD and so all kernels (including
nixos-apple-silicon and rpi kernel) will end up with the max of 33, which will
lead to the systemd-sysctl service failing. Additionally, there are factors
other than the pagesize which can cause 33 to be an invalid argument.
---
 nixos/modules/config/sysctl.nix | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix
index 6b6e8e879012..96bd0e961989 100644
--- a/nixos/modules/config/sysctl.nix
+++ b/nixos/modules/config/sysctl.nix
@@ -96,18 +96,10 @@ in
       # Maximise address space randomisation.
       "vm.mmap_rnd_bits" = lib.mkMerge [
         (lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (
-          let
-            kernel = config.boot.kernelPackages.kernel;
-            isYes = kernel.config.isYes or (_: false);
-          in
-          lib.mkDefault (
-            if isYes "ARM64_64K_PAGES" then
-              29
-            else if isYes "ARM64_16K_PAGES" then
-              31
-            else
-              33
-          )
+          # Ideally, we'd want to set this to 33 on 4K pagesize
+          # kernels, but some vendor kernels e.g. linux_rpi can
+          # do a maximum of 24.
+          lib.mkDefault 24
         ))
         (lib.mkIf pkgs.stdenv.hostPlatform.isx86_64 (lib.mkDefault 32))
       ];