Systemd by itself comes with this wonderful analysis tool. Systemd-analyze security Systemd-analzye security <service> There it details what capabilities, and

Systemd by itself comes with this wonderful analysis tool. Systemd-analyze security Systemd-analzye security <service> There it details what capabilities, and restrictions are in place for a given systemd service. From there you can edit the service to restrict even further as required if you want.