@@ -32,3 +32,4 @@ ProtectSystem=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
+NoNewPrivileges=yes