nixos: maximise mmap ASLR entropy on x86_64 and AArch64

The Linux default of 28 bits on x86_64 and 18 bits (!) on AArch64 is
a legacy holdover; Ubuntu 22.04 LTS and newer use a much more defensible
32 bits here on x86_64, and 33 bits on AArch64.

On AArch64, the maximum depends on page size: 33 bits for 4K pages,
31 bits for 16K pages, and 29 bits for 64K pages (e.g. Asahi Linux).
We query the kernel config to select the right value.

In 32-bit compatibility mode on x86_64 and AArch64, we set 16 bits,
the maximum permitted by the size of the address space.

Other architectures are left at kernel defaults, since the maximums
vary widely (e.g. 24 for riscv64, 18 for loongarch/mips/parisc).

nixos/modules/config/sysctl.nix

@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
 
   sysctlOption = lib.mkOptionType {
@@ -87,6 +92,28 @@ in
       # the value below is used by default on several other distros.
       "fs.inotify.max_user_instances" = lib.mkDefault 524288;
       "fs.inotify.max_user_watches" = lib.mkDefault 524288;
+
+      # Maximise address space randomisation.
+      "vm.mmap_rnd_bits" = lib.mkMerge [
+        (lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (
+          let
+            kernel = config.boot.kernelPackages.kernel;
+            isYes = kernel.config.isYes or (_: false);
+          in
+          lib.mkDefault (
+            if isYes "ARM64_64K_PAGES" then
+              29
+            else if isYes "ARM64_16K_PAGES" then
+              31
+            else
+              33
+          )
+        ))
+        (lib.mkIf pkgs.stdenv.hostPlatform.isx86_64 (lib.mkDefault 32))
+      ];
+      "vm.mmap_rnd_compat_bits" = lib.mkIf (
+        pkgs.stdenv.hostPlatform.isx86_64 || pkgs.stdenv.hostPlatform.isAarch64
+      ) (lib.mkDefault 16);
     };
   };
 }