Apply the full systemd sandboxing profile to a long-running service (ProtectSystem, ProtectHome, NoNewPrivileges, PrivateTmp) so it cannot modify host files or require root

Documented steps

1. Create a unit /etc/systemd/system/<name>.service with Type=exec for long-running processes so systemd waits for execve to succeed
2. Add User= and Group= (or DynamicUser=yes) to drop from root; use DynamicUser=yes when the service needs an ephemeral uid with no static account
3. Add ProtectSystem=strict to make /usr, /boot, /etc read-only, and ProtectHome=yes to hide /home, /root, /run/user
4. Add PrivateTmp=yes (private /tmp and /var/tmp), PrivateDevices=yes (private /dev with only null/zero/random/tty), and NoNewPrivileges=yes to block setuid escalation
5. Add ProtectKernelTunables=yes, ProtectKernelModules=yes, ProtectControlGroups=yes, ProtectKernelLogs=yes to read-only-protect /proc/sys, /sys, /sys/fs/cgroup and block dmesg
6. Run systemctl daemon-reload && systemctl enable --now <name>.service, then systemctl status to confirm active
7. Audit with systemctl cat <name>.service and systemd-analyze security <name>.service --offline=false to review the exposure score