Audit systemd .service unit settings for NoNewPrivileges, PrivateTmp, and ProtectSystem=strict isolation.