anchor.diff:  
   === systemd-analyze and systemd_scan.sh
   
  -Since `systemd` version 240, `systemd-analyze` has the "security" option for
  -analyzing the security and sand-boxing settings of services in order to
  -determine an "exposure level" for them, indicating whether a service would
  -benefit from more sand-boxing options turned on for them.
  +Since `systemd` version 240, `systemd-analyze` has the https://www.freedesktop.org/software/systemd/man/systemd-analyze.html[security]
  +option for analyzing the security and sandboxing settings of services in order
  +to determine an exposure level value for them, indicating whether a service
  +would benefit from more sand-boxing options turned on for them.
   
   https://github.com/konstruktoid/hardening/blob/master/misc/systemd_scan.sh[systemd_scan.sh]
   is a script to check the current `systemd` configuration of a local service,
  
positive.code: ----
  
  <1> "When "none", the core dumps will be logged but not stored permanently."
  <2> "Setting Storage=none and ProcessSizeMax=0 disables all coredump handling except for a log entry."
  
  == Mounts
  
  
negative.code: 
  <1> "space-separated list of IPv4 and IPv6 addresses to use as system DNS servers."
  <2> "space-separated list of IPv4 and IPv6 addresses to use as the fallback DNS servers."
  <3> "If set to `allow-downgrade` DNSSEC validation is attempted, but if the server does not support DNSSEC properly, DNSSEC mode is automatically disabled." Should be set to `true` if possible.
  <4> "When set to `opportunistic` DNS request are attempted to send encrypted with DNS-over-TLS." Shoule be set to `true` if possible.
  
  === /etc/systemd/system.conf
  See https://www.freedesktop.org/software/systemd/man/systemd-system.conf.html[system.conf] and https://www.freedesktop.org/software/systemd/man/systemd.html[systemd, init].
  