First of all, again: great work!

Minor comment here: why have an option for RANDSTRUCT (and not the other grsec config options)?

I would rather let GRKERNSEC_CONFIG_AUTO determine whether to enable or disable RANDSTRUCT than let NixOS make the decision for me (unless there is a good reason).

And if some user wants to force-enable/force-disable this option he could just use kernelExtraConfig, right?