On Thu, Feb 24, 2022 at 7:14 PM Zbigniew Jędrzejewski-Szmek
<zbyszek(a)in.waw.pl> wrote:
systemd-analyze security shows whether units use systemd hardening
features. Those units may well use other features, and may well be
very secure.
My vague recollection from running systemd-analyze security
from some time ago was that it reported lack of sandboxing
on units which used dynamic users (or named users), which,
I would hope, should typically not need things like blocking
clock write access (for example), even if some of the other
available sandboxing options might be useful for those
units.