Eros: a capability system
Jonathan S. Shapiro, David J. Farber, Jonathan M. Smith · 1999
Capabilities define a uniform semantics for system service invocation, enforce separation of concerns and encapsulation, and allow each program to be restricted to exactly that set of authority it requires (the principle of least privilege). Capability systems therefore readily contain and reduce errors at the application level and improve component testability. If carefully architected, a capability system should be both faster and simpler than a comparable access-control-based system. In practice, implementations have failed to demonstrate such performance. This paper provides an architectural overview of EROS, the Extremely Reliable Operating System. EROS is a persistent capability system which provides complete accountability for persistent, consumable and multiplexed resources. By choosing abstractions to leverage conventional hardware protecgion, and exploiting hardware support in the implementation, a fast pure capability architecture can be demonstrated. This paper describes the system design and the proposed evaluation method for EROS. An implementation of EROS for the x86 platform is currently underway, and we expect to report benchmark results by mid 1998. 1