mosquitto: systemd service sandboxing

running the service in a sandbox. read-only root file system,
with tmpfs mounted in /tmp, hidden /root and /home,
temporary /dev. the only writeable path is the data directory,
which according to my experiments is enough for the service
to work correctly.
This commit is contained in:
snicket2100 2020-04-13 10:43:32 +02:00
parent 87d598e310
commit 2b0ee787dd

View file

@ -204,6 +204,16 @@ in
Restart = "on-failure";
ExecStart = "${pkgs.mosquitto}/bin/mosquitto -c ${mosquittoConf}";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
ProtectSystem = "strict";
ProtectHome = true;
PrivateDevices = true;
PrivateTmp = true;
ReadWritePaths = "${cfg.dataDir}";
ProtectControlGroups = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
NoNewPrivileges = true;
};
preStart = ''
rm -f ${cfg.dataDir}/passwd