Hmm, yeah, I should probably blog more about all the nice sandboxing
features we have now in systemd. There's quite some stuff now we
should enable wherever we can. Specifically ProtectSystem=,
ProtectHome=, ProtectKernelTunables=, ProtectKernelModules=,
ProtectedControlGroups=, PrivateUsers=, PrivateTmp=, PrivateDevices=,
PrivateNetwork=, SystemCallFilter=, RestrictAddressFamilies=,
RestrictNamespaces=, MemoryDenyWriteExecute=, RestrictRealtime=.

For now, the only docs available for them are the man pages. Not all
of them are available on all currently maintained Fedoras, but a good
chunk is.

That wasn't quite easy to find although it does make sense in retrospect:

          man systemd.exec

man -k ProtectSystem and man systemd|grep ProtectSystem didn't show anything because they don't really index the man pages.  While looking for this, I came up with a useful technique for combing through man pages: maybe it'll be useful to someone:

for a in $(man -k systemd | cut -f 1 -d ' ') ; do echo $a; man $a | grep ProtectSystem ; done

(the $(man .. cut) combo returns the names of all man pages relevant to systemd, and then we grep through their content)