{
  LockPersonality = true;
  MemoryDenyWriteExecute = true;
  NoNewPrivileges = true;
  PrivateMounts = true;
  PrivateTmp = true;
  ProtectClock = true;
  ProtectControlGroups = true;
  ProtectHome = true;
  ProtectHostname = true;
  ProtectKernelLogs = true;
  ProtectKernelModules = true;
  ProtectKernelTunables = true;
  RestrictNamespaces = true;
  RestrictRealtime = true;
  RestrictSUIDSGID = true;
  SystemCallArchitectures = "native";
  SystemCallFilter = [
    "@known"
    "~@clock"
    "~@cpu-emulation"
    "~@raw-io"
    "~@reboot"
    "~@mount"
    "~@obsolete"
    "~@swap"
    "~@debug"
    "~@keyring"
    "~@pkey"
    "~@chown"
  ];
  UMask = "0077";
  InaccessiblePaths = "/persist";
}
