systemd/Sandboxing - ArchWiki
systemd enables users to harden and sandbox system service units. Because of technical limitations, and ironically security reasons, user units can not be hardened or sandboxed properly since this would make privilege escalation issues possible. This does not affect system units which use the User= directive. Because of the nature of other unit types, only service units can be hardened/sandboxed in the traditional sense. See systemd.exec(5) and systemd.resource-control(5) for more information. Since hardening/sandboxing effectively restricts an application, it is not possible to use all the sandboxing directives. A web server for example should not use PrivateNetwork=true since it usually needs network access. systemd-analyze security unit generates a score for the unit showing all the used directives, which can be helpful to determine what settings to try next. Unfortunately, systemd's error messages on misconfiguration relating to sandboxing are sometimes vague and/or misleading. Set