Kernel Mode
How sysg Meets the Kernel
The sysg supervisor is a userspace program. Kernel mode is the set of kernel interfaces it calls — no sysg code runs in ring 0. This diagram shows which interface each capability uses to cross the userspace→kernel boundary, and how the same manifest is enforced on Linux versus refused on macOS.
On Linux, the supervisor builds each policy in the parent and the forked child
installs it in a fixed order (no_new_privs → Landlock → seccomp)
before exec; cgroups attach post-spawn and pidfd wakes the monitor
on exit. On macOS the same manifest keys have no kernel mechanism to call, so
they are refused with a diagnostic rather than silently ignored, and launchd
only bootstraps the supervisor.
Reading the diagram
- Green paths (Linux) are the kernel interfaces sysg actually calls: cgroup
v2 for limits,
pidfdfor instant exit detection, Landlock for filesystem confinement, and seccomp-bpf for syscall filtering. The child installs the confinement steps in a fixed order immediately beforeexec. - Red paths (macOS) stop at the syscall boundary: those Linux mechanisms do not exist, so requesting them is a refusal (SG0711, SG0721, SG0722, SG0724) — the mode-parity contract: identical behavior where a capability exists, a refusal where it does not.
- The supervisor never enters the kernel itself. It configures kernel mechanisms; the kernel enforces.