From 368bdd13f6552806057ea3b7285a3b56322b69b2 Mon Sep 17 00:00:00 2001 From: Rouven Czerwinski Date: Wed, 24 Feb 2021 05:35:03 +0100 Subject: [PATCH] linux: enable RANDOM_TRUST_CPU Allows the RDRAND instruction to seed the kernel RNG. This should lead to faster CRNG initialization, since the kernel can use the processors capabilities directly. This is default enabled in Debian [1] and Fedora [2] as well. [1]: https://salsa.debian.org/kernel-team/linux/-/blob/debian/5.10.13-1/debian/config/config#L459 [2]: https://src.fedoraproject.org/rpms/kernel/blob/rawhide/f/kernel-x86_64-fedora.config#_4907 --- pkgs/os-specific/linux/kernel/common-config.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 0d93dd485a40..4764f166684e 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -435,6 +435,8 @@ let SECURITY_APPARMOR = yes; DEFAULT_SECURITY_APPARMOR = yes; + RANDOM_TRUST_CPU = yes; # allow RDRAND to seed the RNG + MODULE_SIG = no; # r13y, generates a random key during build and bakes it in # Depends on MODULE_SIG and only really helps when you sign your modules # and enforce signatures which we don't do by default.