Hardened service fails to start

Ok, I figured this out.

So in your override-hardened.conf you have the line

ProcSubset=pid

set. This line will cause procfs to be mounted with the subset=pid option. The subset=pid option means that only /proc/<pid> directories will be visible and no other procfs files.

Consequently, the /run/systemd/unit-root/proc/sys/kernel/domainname file will not be available to the synapse.service. So in order to have a functioning service you will need to disable ProcSubset=pid in your override-hardened.conf. The subset=pid mount option for procfs will be available on reletaviely new kernels. Older kernels that do not support this option will work.