It would be nice to be possible to do the hardening of services via allowlisting instead. E.g. AllowNothing=true and then start adding what is allowed to make the service function.

I think that pledge[0] offers that functionality

[0] https://github.com/jart/pledge