--- rng-tools-6.17/rngd.service.orig	2024-10-05 07:37:16.071162500 +0800
+++ rng-tools-6.17/rngd.service	2024-10-05 07:41:25.726337400 +0800
@@ -1,11 +1,24 @@
 [Unit]
 Description=Hardware RNG Entropy Gatherer Daemon
 ConditionVirtualization=!container
+ConditionKernelCommandLine=!fips=1
 
 # The "-f" option is required for the systemd service rngd to work with Type=simple
 [Service]
 Type=simple
-ExecStart=/usr/sbin/rngd -f
+EnvironmentFile=/etc/sysconfig/rngd
+ExecStart=/usr/sbin/rngd -f $RNGD_ARGS
+NoNewPrivileges=true
+PrivateNetwork=true
+PrivateTmp=true
+ProtectSystem=full
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
 
 [Install]
 WantedBy=multi-user.target