···

       
153
       
153
       
 
       
              CapabilityBoundingSet = [

     

       
154
       
154
       
 
       
                "CAP_NET_BIND_SERVICE" # sockets and tethering

     

       
155
       
155
       
 
       
              ];

     

       
156
       
156
       
+
       
              ConfigurationDirectoryMode = "0755";

     

       
156
       
157
       
 
       
              NoNewPrivileges = true;

     

       
157
       
158
       
 
       
              RestrictNamespaces = true;

     

       
158
       
159
       
 
       
              ProtectControlGroups = true;