nixos/mosquitto: harden systemd unit

It can still network, it can only access the ssl related files if ssl is
enabled.

✗ PrivateNetwork= Service has access to the host's network 0.5
✗ RestrictAddressFamilies=~AF_(INET|INET6) Service may allocate Internet sockets 0.3
✗ DeviceAllow= Service has a device ACL with some special devices 0.1
✗ IPAddressDeny= Service does not define an IP address allow list 0.2
✗ RootDirectory=/RootImage= Service runs within the host's root directory 0.1
✗ RestrictAddressFamilies=~AF_UNIX Service may allocate local sockets 0.1

→ Overall exposure level for mosquitto.service: 1.1 OK 🙂

Changed files
+43 -5
nixos
modules
services
networking
tests
+39 -4
nixos/modules/services/networking/mosquitto.nix
···
ExecStart = "${pkgs.mosquitto}/bin/mosquitto -c ${mosquittoConf}";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-
ProtectSystem = "strict";
-
ProtectHome = true;
+
# Hardening
+
CapabilityBoundingSet = "";
+
DevicePolicy = "closed";
+
LockPersonality = true;
+
MemoryDenyWriteExecute = true;
+
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
-
ReadWritePaths = "${cfg.dataDir}";
+
PrivateUsers = true;
+
ProtectClock = true;
ProtectControlGroups = true;
+
ProtectHome = true;
+
ProtectHostname = true;
+
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
-
NoNewPrivileges = true;
+
ProtectProc = "invisible";
+
ProcSubset = "pid";
+
ProtectSystem = "strict";
+
ReadWritePaths = [
+
cfg.dataDir
+
"/tmp" # mosquitto_passwd creates files in /tmp before moving them
+
];
+
ReadOnlyPaths = with cfg.ssl; lib.optionals (enable) [
+
certfile
+
keyfile
+
cafile
+
];
+
RemoveIPC = true;
+
RestrictAddressFamilies = [
+
"AF_UNIX" # for sd_notify() call
+
"AF_INET"
+
"AF_INET6"
+
];
+
RestrictNamespaces = true;
+
RestrictRealtime = true;
+
RestrictSUIDSGID = true;
+
SystemCallArchitectures = "native";
+
SystemCallFilter = [
+
"@system-service"
+
"~@privileged"
+
"~@resources"
+
];
+
UMask = "0077";
};
preStart = ''
rm -f ${cfg.dataDir}/passwd
+4 -1
nixos/tests/mosquitto.nix
···
-
import ./make-test-python.nix ({ pkgs, ... }:
+
import ./make-test-python.nix ({ pkgs, lib, ... }:
let
port = 1888;
···
];
};
};
+
+
# disable private /tmp for this test
+
systemd.services.mosquitto.serviceConfig.PrivateTmp = lib.mkForce false;
};
client1 = client;