Abstract

Capabilities define a uniform semantics for system service invocation, enforce separation of concerns and encapsulation, and allow each program to be restricted to exactly that set of authority it requires (the principle of least privilege). Capability systems therefore readily contain and reduce errors at the application level and improve component testability. If carefully architected, a capability system should be both faster and simpler than a comparable access-control-based system. In practice, implementations have failed to demonstrate such performance. This paper provides an architectural overview of EROS, the Extremely Reliable Operating System. EROS is a persistent capability system which provides complete accountability for persistent, consumable and multiplexed resources. By choosing abstractions to leverage conventional hardware protecgion, and exploiting hardware support in the implementation, a fast pure capability architecture can be demonstrated. This paper de...

Citations