Thank you!
I was wondering if the way how it’s handled in sdwdate.postinst (legacy prior your pull request) is worth it. syscall whitelists are difficult to maintain as is and the dynamic creation per architecture makes it even more messy. I was contemplating to remove the sdwdate.postinst dynamic creation and move all to the static systemd unit file.