jitterentropy-rngd: fix systemd service to allow mlock and restict ml… (#523359)

nixos/modules/services/security/jitterentropy-rngd.nix

@@ -26,6 +26,11 @@ in
       default = false;
       description = "Force SP800-90B mode for entropy reading";
     };
+    memlockLimit = lib.mkOption {
+      type = lib.types.str;
+      default = "2M";
+      description = "Set limit for lockable memory with mlock";
+    };
     verbose = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -56,6 +61,12 @@ in
           # use service from package with our configured args
           "${cfg.package}/bin/jitterentropy-rngd ${args}"
         ];
+        LimitMEMLOCK = [
+          # clear old setting from built-in service file
+          ""
+          # use service from package with our configured limit
+          "${cfg.memlockLimit}"
+        ];
       };
     };
 

pkgs/by-name/ji/jitterentropy-rngd/package.nix

@@ -19,8 +19,8 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # Allow the systemd service to mlock the daemon's entropy buffer.
     (fetchpatch {
-      url = "https://github.com/smuellerDD/jitterentropy-rngd/compare/v1.3.1...61ad2e7c83b95402536b90b52eabe20ce60cfbd7.patch";
-      hash = "sha256-Twg59vrqJGF0bH4pkIewbReCjabOFuqq+MtCnwjO9lw=";
+      url = "https://github.com/smuellerDD/jitterentropy-rngd/compare/v1.3.1...cee0c7a035e9564d161053012c6ea36b2ce27383.patch";
+      hash = "sha256-zwcY9z9EikrhxZa39p4+gl+/EeZ4sAKaItQfrL1DFSo=";
     })
   ];