Mastering systemd: Securing and sandboxing applications and services
https://documentation.suse.com/en-us/smart/security/html/systemd-securing/index.html
https://docs.rockylinux.org/guides/security/systemd_hardening/
https://www.redhat.com/en/blog/mastering-systemd
https://linux-audit.com/systemd/how-to-harden-a-systemd-service-unit/
Check linux capabilities:
$ zypper install libcap-ng-utils
$ pscap -a