/usr/sbin/mosquitto {
	#include <abstractions/base>
	#include <abstractions/nameservice>

	/usr/sbin/mosquitto r,
	/etc/mosquitto/mosquitto.conf r,
	/etc/mosquitto/ca_certificates/* r,
	/etc/mosquitto/cert/* r,
	/etc/mosquitto/conf.d/* r,
	/var/lib/mosquitto/ r,
	/var/lib/mosquitto/mosquitto.db rwk,
	/var/run/mosquitto.pid rw,

	network inet stream,
	network inet6 stream,
	network inet dgram,
	network inet6 dgram,

	# For drop privileges
	capability setgid,
	capability setuid,

	# For tcp-wrappers
	/lib{,32,64}/libwrap.so*  rm,
	/etc/hosts.allow r,
	/etc/hosts.deny r,
}