imho adding a few lines to the systemd unit file is waaaaaay easier than apparmor

and really, these should be written by the developers, not distro maintainers

poking around on my Ubuntu machine, a few daemons have some hardening, chronyd looks pretty good