From c0769dc6effc042209ede41330946bbe34b9ec90 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Sun, 13 Aug 2017 00:17:43 +0200 Subject: [PATCH] nixos/hardened profile: increase ASLR entropy --- nixos/modules/profiles/hardened.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix index 0a0838431da..0ab210cc4c3 100644 --- a/nixos/modules/profiles/hardened.nix +++ b/nixos/modules/profiles/hardened.nix @@ -59,4 +59,10 @@ with lib; # the feature at runtime. Attempting to create a user namespace # with unshare will then fail with "no space left on device". boot.kernel.sysctl."user.max_user_namespaces" = mkDefault 0; + + # Raise ASLR entropy for 64bit & 32bit, respectively. + # + # Note: mmap_rnd_compat_bits may not exist on 64bit. + boot.kernel.sysctl."vm.mmap_rnd_bits" = mkDefault 32; + boot.kernel.sysctl."vm.mmap_rnd_compat_bits" = mkDefault 16; }