feat: Attempt to Harden User service

snotify.service

@@ -5,9 +5,33 @@ After=dbus.service
 [Service]
 ExecStart=/usr/bin/snotify
 Restart=always
-RestartSec=1
+RestartSec=1s
 MemoryHigh=16M
 MemoryMax=20M
+OOMPolicy=kill
+
+
+CapabilityBoundingSet=
+AmbientCapabilities=
+
+ProtectSystem=strict
+ProtectHome=read-only
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectHostname=yes
+ProtectClock=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=
+RestrictNamespaces=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RemoveIPC=yes
+SystemCallArchitectures=native
 
 [Install]
 WantedBy=default.target