Eros: a capability system

Capabilities define a uniform semantics for system service invocation, enforce separation of concernsand encapsulation, and allow each program to be restricted to exactly that set of authority itrequires (the principle of least privilege). Capability systems therefore readily contain and reduceerrors at the application level and improve component testability. If carefully architected, a capabilitysystem should be both faster and simpler than a comparable access-control-based system. In...