From 4971c9331a72deeda85ba8d8018a5b07ee6f1635 Mon Sep 17 00:00:00 2001
From: edef <edef@edef.eu>
Date: Wed, 15 Apr 2026 17:53:12 +0000
Subject: [PATCH] nixos: maximise mmap ASLR entropy on x86_64 and AArch64

The Linux default of 28 bits on x86_64 and 18 bits (!) on AArch64 is
a legacy holdover; Ubuntu 22.04 LTS and newer use a much more defensible
32 bits here on x86_64, and 33 bits on AArch64.

On AArch64, the maximum depends on page size: 33 bits for 4K pages,
31 bits for 16K pages, and 29 bits for 64K pages (e.g. Asahi Linux).
We query the kernel config to select the right value.

In 32-bit compatibility mode on x86_64 and AArch64, we set 16 bits,
the maximum permitted by the size of the address space.

Other architectures are left at kernel defaults, since the maximums
vary widely (e.g. 24 for riscv64, 18 for loongarch/mips/parisc).
---
 nixos/modules/config/sysctl.nix | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix
index a45fe8d88d56..6b6e8e879012 100644
--- a/nixos/modules/config/sysctl.nix
+++ b/nixos/modules/config/sysctl.nix
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
 
   sysctlOption = lib.mkOptionType {
@@ -87,6 +92,28 @@ in
       # the value below is used by default on several other distros.
       "fs.inotify.max_user_instances" = lib.mkDefault 524288;
       "fs.inotify.max_user_watches" = lib.mkDefault 524288;
+
+      # Maximise address space randomisation.
+      "vm.mmap_rnd_bits" = lib.mkMerge [
+        (lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (
+          let
+            kernel = config.boot.kernelPackages.kernel;
+            isYes = kernel.config.isYes or (_: false);
+          in
+          lib.mkDefault (
+            if isYes "ARM64_64K_PAGES" then
+              29
+            else if isYes "ARM64_16K_PAGES" then
+              31
+            else
+              33
+          )
+        ))
+        (lib.mkIf pkgs.stdenv.hostPlatform.isx86_64 (lib.mkDefault 32))
+      ];
+      "vm.mmap_rnd_compat_bits" = lib.mkIf (
+        pkgs.stdenv.hostPlatform.isx86_64 || pkgs.stdenv.hostPlatform.isAarch64
+      ) (lib.mkDefault 16);
     };
   };
 }