@@ -20,8 +20,7 @@ let
2020 acl_file ${aclFile}
2121 persistence true
2222 allow_anonymous ${boolToString cfg.allowAnonymous}
23− bind_address ${cfg.host}
24− port ${toString cfg.port}
23+ listener ${toString cfg.port} ${cfg.host}
2524 ${passwordConf}
2625 ${listenerConf}
2726 ${cfg.extraConf}
@@ -233,15 +232,50 @@ in
233232 ExecStart = "${pkgs.mosquitto}/bin/mosquitto -c ${mosquittoConf}";
234233 ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
235234
236− ProtectSystem = "strict";
237− ProtectHome = true;
235+ # Hardening
236+ CapabilityBoundingSet = "";
237+ DevicePolicy = "closed";
238+ LockPersonality = true;
239+ MemoryDenyWriteExecute = true;
240+ NoNewPrivileges = true;
238241 PrivateDevices = true;
239242 PrivateTmp = true;
240− ReadWritePaths = "${cfg.dataDir}";
243+ PrivateUsers = true;
244+ ProtectClock = true;
241245 ProtectControlGroups = true;
246+ ProtectHome = true;
247+ ProtectHostname = true;
248+ ProtectKernelLogs = true;
242249 ProtectKernelModules = true;
243250 ProtectKernelTunables = true;
244− NoNewPrivileges = true;
251+ ProtectProc = "invisible";
252+ ProcSubset = "pid";
253+ ProtectSystem = "strict";
254+ ReadWritePaths = [
255+ cfg.dataDir
256+ "/tmp" # mosquitto_passwd creates files in /tmp before moving them
257+ ];
258+ ReadOnlyPaths = with cfg.ssl; lib.optionals (enable) [
259+ certfile
260+ keyfile
261+ cafile
262+ ];
263+ RemoveIPC = true;
264+ RestrictAddressFamilies = [
265+ "AF_UNIX" # for sd_notify() call
266+ "AF_INET"
267+ "AF_INET6"
268+ ];
269+ RestrictNamespaces = true;
270+ RestrictRealtime = true;
271+ RestrictSUIDSGID = true;
272+ SystemCallArchitectures = "native";
273+ SystemCallFilter = [
274+ "@system-service"
275+ "~@privileged"
276+ "~@resources"
277+ ];
278+ UMask = "0077";
245279 };
246280 preStart = ''
247281 rm -f ${cfg.dataDir}/passwd