doctor@PRTS-VM:~$ sudo systemctl cat dde-dconfig-daemon.service 
# /usr/lib/systemd/system/dde-dconfig-daemon.service
[Unit]
Description=dde-dconfig-daemon service

# Ask for the dbus socket.
Wants=dbus.socket
After=dbus.socket

[Service]
Type=dbus
User=deepin-daemon
BusName=org.desktopspec.ConfigManager
ExecStart=/usr/bin/dde-dconfig-daemon
Environment=DSG_DATA_DIRS=/usr/share/dsg:/var/lib/linglong/entries/share/>

ReadOnlyPaths=/usr/share/dsg -/var/lib/linglong/entries/share/dsg

StateDirectory=dde-dconfig-daemon
StateDirectoryMode=0700
LogsDirectory=deepin

DevicePolicy=closed

ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
#PrivateDevices=yes
PrivateNetwork=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=yes
LockPersonality=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
lines 11-40/40 (END)
User=deepin-daemon
BusName=org.desktopspec.ConfigManager
ExecStart=/usr/bin/dde-dconfig-daemon
Environment=DSG_DATA_DIRS=/usr/share/dsg:/var/lib/linglong/entries/share/dsg

ReadOnlyPaths=/usr/share/dsg -/var/lib/linglong/entries/share/dsg

StateDirectory=dde-dconfig-daemon
StateDirectoryMode=0700
LogsDirectory=deepin

DevicePolicy=closed

ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
#PrivateDevices=yes
PrivateNetwork=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=yes
LockPersonality=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
~
~
lines 11-40/40 (END)
User=deepin-daemon
BusName=org.desktopspec.ConfigManager
ExecStart=/usr/bin/dde-dconfig-daemon
Environment=DSG_DATA_DIRS=/usr/share/dsg:/var/lib/linglong/entries/share/dsg

ReadOnlyPaths=/usr/share/dsg -/var/lib/linglong/entries/share/dsg

StateDirectory=dde-dconfig-daemon
StateDirectoryMode=0700
LogsDirectory=deepin

DevicePolicy=closed

ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
#PrivateDevices=yes
PrivateNetwork=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=yes
LockPersonality=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RemoveIPC=yes