commit 33e867620eb1e27d44a35fb57944ce8a5bccfdab · pyrox.dev/nixpkgs

+39 -4

nixos/modules/services/networking/mosquitto.nix

···

       233
       233
        
               ExecStart = "${pkgs.mosquitto}/bin/mosquitto -c ${mosquittoConf}";

     

       234
       234
        
               ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";

     

       235
       235
        
       

     

       236
       236
       -
               ProtectSystem = "strict";

     

       237
       237
       -
               ProtectHome = true;

     

       236
       236
       +
               # Hardening

     

       237
       237
       +
               CapabilityBoundingSet = "";

     

       238
       238
       +
               DevicePolicy = "closed";

     

       239
       239
       +
               LockPersonality = true;

     

       240
       240
       +
               MemoryDenyWriteExecute = true;

     

       241
       241
       +
               NoNewPrivileges = true;

     

       238
       242
        
               PrivateDevices = true;

     

       239
       243
        
               PrivateTmp = true;

     

       240
       240
       -
               ReadWritePaths = "${cfg.dataDir}";

     

       244
       244
       +
               PrivateUsers = true;

     

       245
       245
       +
               ProtectClock = true;

     

       241
       246
        
               ProtectControlGroups = true;

     

       247
       247
       +
               ProtectHome = true;

     

       248
       248
       +
               ProtectHostname = true;

     

       249
       249
       +
               ProtectKernelLogs = true;

     

       242
       250
        
               ProtectKernelModules = true;

     

       243
       251
        
               ProtectKernelTunables = true;

     

       244
       244
       -
               NoNewPrivileges = true;

     

       252
       252
       +
               ProtectProc = "invisible";

     

       253
       253
       +
               ProcSubset = "pid";

     

       254
       254
       +
               ProtectSystem = "strict";

     

       255
       255
       +
               ReadWritePaths = [

     

       256
       256
       +
                 cfg.dataDir

     

       257
       257
       +
                 "/tmp"  # mosquitto_passwd creates files in /tmp before moving them

     

       258
       258
       +
               ];

     

       259
       259
       +
               ReadOnlyPaths = with cfg.ssl; lib.optionals (enable) [

     

       260
       260
       +
                 certfile

     

       261
       261
       +
                 keyfile

     

       262
       262
       +
                 cafile

     

       263
       263
       +
               ];

     

       264
       264
       +
               RemoveIPC = true;

     

       265
       265
       +
               RestrictAddressFamilies = [

     

       266
       266
       +
                 "AF_UNIX"  # for sd_notify() call

     

       267
       267
       +
                 "AF_INET"

     

       268
       268
       +
                 "AF_INET6"

     

       269
       269
       +
               ];

     

       270
       270
       +
               RestrictNamespaces = true;

     

       271
       271
       +
               RestrictRealtime = true;

     

       272
       272
       +
               RestrictSUIDSGID = true;

     

       273
       273
       +
               SystemCallArchitectures = "native";

     

       274
       274
       +
               SystemCallFilter = [

     

       275
       275
       +
                 "@system-service"

     

       276
       276
       +
                 "~@privileged"

     

       277
       277
       +
                 "~@resources"

     

       278
       278
       +
               ];

     

       279
       279
       +
               UMask = "0077";

     

       245
       280
        
             };

     

       246
       281
        
             preStart = ''

     

       247
       282
        
               rm -f ${cfg.dataDir}/passwd

+4 -1

nixos/tests/mosquitto.nix

···

       1
       1
       -
       import ./make-test-python.nix ({ pkgs, ... }:

     

       1
       1
       +
       import ./make-test-python.nix ({ pkgs, lib, ... }:

     

       2
       2
        
       

     

       3
       3
        
       let

     

       4
       4
        
         port = 1888;

     
···

       30
       30
        
                 ];

     

       31
       31
        
               };

     

       32
       32
        
             };

     

       33
       33
       +
       

     

       34
       34
       +
             # disable private /tmp for this test

     

       35
       35
       +
             systemd.services.mosquitto.serviceConfig.PrivateTmp = lib.mkForce false;

     

       33
       36
        
           };

     

       34
       37
        
       

     

       35
       38
        
           client1 = client;