code: func seccompUnitOptions(opts []*unit.UnitOption, sf *seccompFilter) ([]*unit.UnitOption, error) {
  	if sf == nil {
  		return opts, nil
  	}
  	if sf.errno != "" {
  		opts = append(opts, unit.NewUnitOption("Service", "SystemCallErrorNumber", sf.errno))
  	}
  
  	var filterPrefix string
  	switch sf.mode {
  	case ModeWhitelist:
  		filterPrefix = sdWhitelistPrefix
  	case ModeBlacklist:
  		filterPrefix = sdBlacklistPrefix
  	default:
  		return nil, fmt.Errorf("unknown filter mode %v", sf.mode)
  	}
  
  	// SystemCallFilter options are written down one entry per line, because
  	// filtering sets may be quite large and overlong lines break unit serialization.
  	opts = appendOptionsList(opts, "Service", "SystemCallFilter", filterPrefix, sf.syscalls...)
  	return opts, nil
  }
docs: // seccompUnitOptions converts a concrete seccomp filter to systemd unit options