From d14ba1e1add6cca568515f87508ad5d00180bf16 Mon Sep 17 00:00:00 2001
From: Daniel Frank <git@danielfrank.net>
Date: Fri, 18 Oct 2019 00:30:11 +0200
Subject: [PATCH] security.rngd: start rngd during early boot to reduce entropy
starvation due to encrypted swap and remove PrivateTmp to avoid a circular
dependency
---
nixos/modules/security/rngd.nix | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/nixos/modules/security/rngd.nix b/nixos/modules/security/rngd.nix
index d9d6d9c9f253..5566c53897dc 100644
--- a/nixos/modules/security/rngd.nix
+++ b/nixos/modules/security/rngd.nix
@@ -39,12 +39,15 @@ in
description = "Hardware RNG Entropy Gatherer Daemon";
+ # rngd may have to start early to avoid entropy starvation during boot with encrypted swap
+ unitConfig.DefaultDependencies = false;
serviceConfig = {
ExecStart = "${pkgs.rng-tools}/sbin/rngd -f"
+ optionalString cfg.debug " -d";
+ # PrivateTmp would introduce a circular dependency if /tmp is on tmpfs and swap is encrypted,
+ # thus depending on rngd before swap, while swap depends on rngd to avoid entropy starvation.
NoNewPrivileges = true;
PrivateNetwork = true;
- PrivateTmp = true;
ProtectSystem = "full";
ProtectHome = true;
};