Unless you consider systemd's security features (filtering available syscalls), there's literally no interposition between apps and the kernel.