Description of problem:
I'm not sure on which component this goes but memcached gets an invalid configuration option in the systemd script:

root@overcloud-serviceapi-0 heat-admin]# systemctl status memcached
● memcached.service - memcached daemon
   Loaded: loaded (/usr/lib/systemd/system/memcached.service; enabled; vendor preset: disabled)
   Active: active (running) since Fri 2016-11-18 16:09:57 UTC; 50min ago
 Main PID: 20531 (memcached)
   CGroup: /system.slice/memcached.service
           └─20531 /usr/bin/memcached -p 11211 -u memcached -m 15087 -c 8192 -l 10.0.0.13 -U 11211 -t 4 >> /var/log/memcached.log 2>&1

Nov 18 16:17:51 overcloud-serviceapi-0.localdomain systemd[1]: [/usr/lib/systemd/system/memcached.service:43] Unknown lvalue 'MemoryDenyWriteExecute' in section 'Service'
Nov 18 16:17:54 overcloud-serviceapi-0.localdomain systemd[1]: [/usr/lib/systemd/system/memcached.service:43] Unknown lvalue 'MemoryDenyWriteExecute' in section 'Service'
Nov 18 16:17:54 overcloud-serviceapi-0.localdomain systemd[1]: [/usr/lib/systemd/system/memcached.service:43] Unknown lvalue 'MemoryDenyWriteExecute' in section 'Service'
Nov 18 16:19:25 overcloud-serviceapi-0.localdomain systemd[1]: [/usr/lib/systemd/system/memcached.service:43] Unknown lvalue 'MemoryDenyWriteExecute' in section 'Service'
Nov 18 16:20:01 overcloud-serviceapi-0.localdomain systemd[1]: [/usr/lib/systemd/system/memcached.service:43] Unknown lvalue 'MemoryDenyWriteExecute' in section 'Service'
Nov 18 16:20:02 overcloud-serviceapi-0.localdomain systemd[1]: [/usr/lib/systemd/system/memcached.service:43] Unknown lvalue 'MemoryDenyWriteExecute' in section 'Service'
Nov 18 16:20:02 overcloud-serviceapi-0.localdomain systemd[1]: [/usr/lib/systemd/system/memcached.service:43] Unknown lvalue 'MemoryDenyWriteExecute' in section 'Service'
Nov 18 16:20:03 overcloud-serviceapi-0.localdomain systemd[1]: [/usr/lib/systemd/system/memcached.service:43] Unknown lvalue 'MemoryDenyWriteExecute' in section 'Service'
Nov 18 16:24:39 overcloud-serviceapi-0.localdomain systemd[1]: [/usr/lib/systemd/system/memcached.service:43] Unknown lvalue 'MemoryDenyWriteExecute' in section 'Service'
Nov 18 16:24:39 overcloud-serviceapi-0.localdomain systemd[1]: [/usr/lib/systemd/system/memcached.service:43] Unknown lvalue 'MemoryDenyWriteExecute' in section 'Service'


Version-Release number of selected component (if applicable):
systemd-219-30.el7_3.6.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Deploy overcloud 
2. Check memcached status

Actual results:
Nov 18 16:24:39 overcloud-serviceapi-0.localdomain systemd[1]: [/usr/lib/systemd/system/memcached.service:43] Unknown lvalue 'MemoryDenyWriteExecute' in section 'Service'

Expected results:
No errors.

Additional info:
The MemoryDenyWriteExecute option seems to have been introduced in version 231:
https://github.com/systemd/systemd/blob/master/NEWS


[root@overcloud-serviceapi-0 heat-admin]# cat /usr/lib/systemd/system/memcached.service
# It's not recommended to modify this file in-place, because it will be
# overwritten during upgrades.  If you want to customize, the best
# way is to use the "systemctl edit" command to create an override unit.

# For example, to pass additional options, create an override unit
# (as is done by systemctl edit) and enter the following:

#     [Service]
#     Environment=OPTIONS="-l 127.0.0.1,::1"


[Unit]
Description=memcached daemon
Before=httpd.service
After=network.target

[Service]
EnvironmentFile=/etc/sysconfig/memcached
ExecStart=/usr/bin/memcached -p ${PORT} -u ${USER} -m ${CACHESIZE} -c ${MAXCONN} $OPTIONS

# Set up a new file system namespace and mounts private /tmp and /var/tmp directories
# so this service cannot access the global directories and other processes cannot
# access this service's directories.
PrivateTmp=true

# Mounts the /usr, /boot, and /etc directories read-only for processes invoked by this unit.
ProtectSystem=full

# Ensures that the service process and all its children can never gain new privileges
NoNewPrivileges=true

# Sets up a new /dev namespace for the executed processes and only adds API pseudo devices
# such as /dev/null, /dev/zero or /dev/random (as well as the pseudo TTY subsystem) to it,
# but no physical devices such as /dev/sda.
PrivateDevices=true

# Required for dropping privileges and running as a different user
CapabilityBoundingSet=CAP_SETGID CAP_SETUID
LimitNOFILE=16384

# Attempts to create memory mappings that are writable and executable at the same time,
# or to change existing memory mappings to become executable are prohibited.
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target