_full¶

sd¶

Part of the systemd (as PID 1) profile.

sd is a profile for s**ystem**d-executor run as root. It is used to run all service files and to encapsulate stacked service profiles (hence the short name, to keep the security attribute easy to read). By design, this profile must be as broad as all the profiles it runs combined, so it uses the unconfined flag.

The unconfined flag also avoids the AppArmor No New Privileges (NNP) restriction. Many services run with NoNewPrivileges=yes, and under NNP a confined task can only transition to a profile stacked on its current one (sd//&<service>). An unconfined profile is exempt from this restriction, so services can transition to their own profile without being stacked with sd.

It aims to reduce the size of the systemd profile.

sd-mount¶

Part of the systemd (as PID 1) profile.

sd-mount is a subprofile of sd responsible to handle mounting operation.

sd-umount¶

Part of the systemd (as PID 1) profile.

sd-umount is a subprofile of sd responsible to handle unmounting operation.

sdu¶

Part of the systemd-user profile.

sdu is a profile for s**ystem**d-executor run as **u**ser. It is used to run all service files and to encapsulate stacked service profiles (hence the short name). By design, this profile must be as broad as all the profiles it runs combined, so it uses the unconfined flag. As for sd, it also avoids the NNP restriction, so user services do not have to be stacked with sdu.

It aims to reduce the size of the systemd-user profile.

systemd¶

Profile for systemd (PID 1), it does not specify an attachment path because it is directly loaded by systemd.

Overall architecture of the systemd profiles:

systemd                                # PID 1, entrypoint, requires "Early policy"
├── systemd                            # To restart itself
├── systemd-generators-*               # Systemd system and environment generators
└── sd (unconfined)                    # Internal service starter and config handler, handles all services
    ├── pix,                           # Any service with profile
    ├── sd//systemctl                  # Internal system systemctl
    └── systemd-user                   # Profile for 'systemd --user'
        ├── systemd-user               # To restart itself
        ├── systemd-user-generators-*  # Systemd user and environment generators
        └── sdu (unconfined)           # Handles all user services
            ├── pix,                   # Any user service with profile
            └── sdu//systemctl         # Internal user systemctl

Advantages:

• Differentiate systemd (PID 1) and system --user
• Keep systemd and systemd-user as mininal as possible, and transition to less privileged profiles.
• Allow the executor profiles to handle stacked profiles.
• Most additions need to be done in the sd/sdu profile, not in systemd/systemd-user.
• Dedicated sd-mount profile for most mount from the unit services.

systemd-user¶

Profile for systemd --user, not PID 1 but the user manager for any UID. It does not specify an attachment path because it is intended to be used only via px -> systemd-user exec transitions from the systemd profile.