systemd-resolved needs access to network privileges, so it runs as a system service, it drops its permissions anyways