A little sandboxing for systemd services

A service that reads config and writes one directory has the whole filesystem by default. systemd offers cheap isolation without containers:

[Service]
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true
ReadWritePaths=/var/lib/app
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX

ProtectSystem=strict makes /usr, /boot and /etc read-only, leaving only ReadWritePaths writable. PrivateTmp gives the unit its own /tmp, so temporary files cannot collide with another service.

systemd-analyze security <unit> scores the unit and lists what is still open. Add one option at a time and watch for Permission denied, rather than enabling everything at once.