From 86694481f20b2c213e563d160499743064d35f2e Mon Sep 17 00:00:00 2001
From: Angel J <78835633+iamanaws@users.noreply.github.com>
Date: Tue, 26 May 2026 19:25:18 -0700
Subject: [PATCH] jitterentropy-rngd: add configurable memlock limit

---
 .../modules/services/security/jitterentropy-rngd.nix  | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/nixos/modules/services/security/jitterentropy-rngd.nix b/nixos/modules/services/security/jitterentropy-rngd.nix
index ebf9b5ed8f76..71e1c183b2d8 100644
--- a/nixos/modules/services/security/jitterentropy-rngd.nix
+++ b/nixos/modules/services/security/jitterentropy-rngd.nix
@@ -26,6 +26,11 @@ in
       default = false;
       description = "Force SP800-90B mode for entropy reading";
     };
+    memlockLimit = lib.mkOption {
+      type = lib.types.str;
+      default = "2M";
+      description = "Set limit for lockable memory with mlock";
+    };
     verbose = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -56,6 +61,12 @@ in
           # use service from package with our configured args
           "${cfg.package}/bin/jitterentropy-rngd ${args}"
         ];
+        LimitMEMLOCK = [
+          # clear old setting from built-in service file
+          ""
+          # use service from package with our configured limit
+          "${cfg.memlockLimit}"
+        ];
       };
     };