UserParameter=eig.kernel.security,uname -r | if grep -q lve; then grep -c restrict_mode /proc/cmdline; fi