Eros (operating system)

Eros (operating system)
Name	Eros
Developer	The EROS Group
Family	Capability-based
Working state	Historical
Source model	Open source
Latest release	2006
Kernel type	Microkernel
License	GNU General Public License

Eros (operating system) is an experimental capability-based operating system kernel project developed to explore persistent, secure, and principled resource management. It emphasized software reliability, fine-grained access control, and long-term persistence across restarts, drawing on research from academic institutions and research labs to advance microkernel design and capability model theory. The project influenced later systems through its implementations, publications, and outreach to communities focused on secure computing and formal verification.

Overview

Eros was a research effort that produced a capability-based microkernel designed to provide strong isolation and recoverable persistence for processes, files, and devices. The project aimed to demonstrate practical uses of the capability system concept popularized in discussions involving David Wheeler, Norman Hardy, and other systems researchers, while engaging with contemporaneous work at institutions such as Carnegie Mellon University, Massachusetts Institute of Technology, and University of Cambridge. Eros sought to bridge academic theory and engineering practice, influencing projects at organizations like IBM Research, Microsoft Research, and HP Labs.

Design and Architecture

Eros was built around a small trusted computing base implementing a capability-secure address space and persistent storage across reboots. Its architecture adopted ideas from the Mach (kernel), L4 (microkernel), and KeyKOS families, while also drawing conceptual links to the CapROS and Coyotos successors. The kernel provided capability invocation as the primary inter-process communication mechanism, with designs informed by seminal work at Bell Labs, Stanford University, and University of Utah. The system addressed componentization and least-privilege principles discussed in literature produced at DARPA-funded projects and research groups collaborating with SRI International.

Implementation and Features

Implemented primarily in C with critical sections in Assembly language, Eros included a file system, paged virtual memory, device drivers, and a capability file that encoded authorizations. The system incorporated ideas tested in earlier systems such as AmigaOS, UNIX, and Plan 9 from Bell Labs while experimenting with persistent object storage akin to work at Xerox PARC. Development artifacts and design documents were circulated among contributors from academic labs including Princeton University, University of Cambridge Computer Laboratory, and University of Pennsylvania, and were discussed at conferences like USENIX, ACM SIGOPS, and IEEE S&P.

Security Model

Eros’s security model centered on unforgeable capabilities as tokens of authority, enforcing confinement and least privilege without reliance on global access control lists or ambient authority. This approach resonated with capability-theoretic treatments from researchers at MITRE Corporation, NIST, and Cornell University, and paralleled ideas appearing in the seL4 formal verification work at NICTA and University of New South Wales. The design enabled compartmentalization comparable to techniques used in SELinux and seL4-based systems, while focusing on persistent integrity across power cycles—an aspect of interest to NSA-funded assurance programs.

Performance and Evaluation

Performance evaluations of Eros compared microkernel IPC overhead, paging throughput, and persistence costs against monolithic kernels like Linux and other microkernels such as L4. Benchmarks and academic analyses presented at venues including ACM SOSP and USENIX OSDI illustrated trade-offs between strong isolation and raw throughput, similar to debates surrounding Mach-derived systems and microkernel performance research at Carnegie Mellon University and University of California, Berkeley. Results informed optimizations later applied in capability-oriented successors and in formal analysis efforts at Oxford University and ETH Zurich.

History and Development

Eros originated from collaborations among researchers and graduate students interested in capability systems and persistence, with ties to earlier work on KeyKOS and subsequent efforts like CapROS and Coyotos. Development unfolded across university campuses and independent labs during the late 1990s and early 2000s, intersecting with discussions at conferences such as ACM SIGOPS Symposium and workshops hosted by DARPA and NSF. The codebase, demonstrators, and papers influenced follow-on projects and academic curricula at institutions including Princeton, MIT, UC Berkeley, and University of Cambridge Computer Laboratory.

Influence and Legacy

Although Eros did not become a mainstream production system, its exploration of persistent capabilities informed systems research and contributed to the revival of capability-oriented design in projects like CapROS, Coyotos, and formal verification efforts exemplified by seL4. The project’s artifacts and publications have been cited by researchers at Microsoft Research, IBM Research, ETH Zurich, University of Cambridge, and NICTA, and remain a reference point in studies of microkernel security, trusted computing bases, and long-term persistence strategies in operating systems. Its legacy persists in curricula, conference presentations, and the design vocabulary used by contemporary secure OS initiatives.

Category:Capability-based operating systems Category:Microkernels