[Service]
ProtectSystem=strict
ReadWritePaths=/var/lib/grafana /var/log/grafana /run/grafana
SystemCallFilter=@system-service
