In my tests the following systemd security settings allow auditd to do
everything it needs to do in a default configuration.  While the freeze is
getting close this is a simple thing to test and we should be able to get
most of these settings tested well enough before the release.

[Service]
CapabilityBoundingSet=CAP_AUDIT_CONTROL CAP_AUDIT_WRITE CAP_CHOWN CAP_FSETID CAP_NET_BIND_SERVICE CAP_SYS_NICE CAP_SYS_RESOURCE
ProtectSystem=true
ProtectProc=invisible
SystemCallArchitectures=native
DevicePolicy=closed
UMask=077
NoNewPrivileges=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectSystem=true
ProtectHome=true
PrivateTmp=true
ProtectHostname=true
LockPersonality=true
RestrictRealtime=true
RestrictSUIDSGID=true
# needs @resources and @privileged syscall groups
SystemCallFilter=~@mount @cpu-emulation @debug @raw-io @reboot @swap @module @obsolete @clock
ProtectClock=true
RestrictNamespaces=true
ProtectKernelTunables=true
PrivateDevices=true
PrivateNetwork=true
RestrictAddressFamilies=~AF_(INET|INET6)