aboutsummaryrefslogtreecommitdiff
path: root/nixos/modules/services/networking/mosquitto.nix
diff options
context:
space:
mode:
Diffstat (limited to 'nixos/modules/services/networking/mosquitto.nix')
-rw-r--r--nixos/modules/services/networking/mosquitto.nix10
1 files changed, 10 insertions, 0 deletions
diff --git a/nixos/modules/services/networking/mosquitto.nix b/nixos/modules/services/networking/mosquitto.nix
index 4a85b3956dae..10b49d9b2206 100644
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@@ -232,6 +232,16 @@ in
Restart = "on-failure";
ExecStart = "${pkgs.mosquitto}/bin/mosquitto -c ${mosquittoConf}";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+
+ ProtectSystem = "strict";
+ ProtectHome = true;
+ PrivateDevices = true;
+ PrivateTmp = true;
+ ReadWritePaths = "${cfg.dataDir}";
+ ProtectControlGroups = true;
+ ProtectKernelModules = true;
+ ProtectKernelTunables = true;
+ NoNewPrivileges = true;
};
preStart = ''
rm -f ${cfg.dataDir}/passwd