Add the PrivateTmp, ProtectHome, and ProtectSystem directives to better secure the system from chronyd. It's taken from the Debian chrony package.