diff options
author | Michele Guerini Rocco <rnhmjoj@users.noreply.github.com> | 2020-02-12 01:28:03 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-02-12 01:28:03 +0100 |
commit | 48704fbd4fc4dc9660ab04f938048b4894ecb140 (patch) | |
tree | bfcc0e1b28c219b5d32f742f87a4b8f8ded6c391 /nixos/modules/security | |
parent | 2f618146653ed55632fc2f0c720aec16246cf1a3 (diff) | |
parent | d14ba1e1add6cca568515f87508ad5d00180bf16 (diff) | |
download | nixlib-48704fbd4fc4dc9660ab04f938048b4894ecb140.tar nixlib-48704fbd4fc4dc9660ab04f938048b4894ecb140.tar.gz nixlib-48704fbd4fc4dc9660ab04f938048b4894ecb140.tar.bz2 nixlib-48704fbd4fc4dc9660ab04f938048b4894ecb140.tar.lz nixlib-48704fbd4fc4dc9660ab04f938048b4894ecb140.tar.xz nixlib-48704fbd4fc4dc9660ab04f938048b4894ecb140.tar.zst nixlib-48704fbd4fc4dc9660ab04f938048b4894ecb140.zip |
Merge pull request #71302 from tokudan/encrypted-swap-entropy-fix
rngd: Start early during boot and encrypted swap entropy fix
Diffstat (limited to 'nixos/modules/security')
-rw-r--r-- | nixos/modules/security/rngd.nix | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/nixos/modules/security/rngd.nix b/nixos/modules/security/rngd.nix index d9d6d9c9f253..5566c53897dc 100644 --- a/nixos/modules/security/rngd.nix +++ b/nixos/modules/security/rngd.nix @@ -39,12 +39,15 @@ in description = "Hardware RNG Entropy Gatherer Daemon"; + # rngd may have to start early to avoid entropy starvation during boot with encrypted swap + unitConfig.DefaultDependencies = false; serviceConfig = { ExecStart = "${pkgs.rng-tools}/sbin/rngd -f" + optionalString cfg.debug " -d"; + # PrivateTmp would introduce a circular dependency if /tmp is on tmpfs and swap is encrypted, + # thus depending on rngd before swap, while swap depends on rngd to avoid entropy starvation. NoNewPrivileges = true; PrivateNetwork = true; - PrivateTmp = true; ProtectSystem = "full"; ProtectHome = true; }; |