Guix System ships two sysctl entries, no firewall and thirteen setuid binaries. Here’s what I added on top, and what I left out.