A Look at the EROS Operating System Jonathan S. Shapiro Johns Hopkins University Abstract EROS is a capability-based, secure operating system originally designed to address the needs of shared computing utilities involving mutually suspicious users. The deploy­ ment plan for the original design was to provide leased compute service to competing business entities, potentially running on a single machine. As a result, the system was structured to preserve security in the face of both hostile dynamic content and hostile users. While the EROS platform can support the efficient deployment of multilevel se­ cure environments, it is primarily focused on business security requirements. These re­ quirements often address integrity as well as security concerns. An EROS-based deploy­ ment can ensure that business-critical data is manipulated exclusively by authorized ap­ plication software, which in turn is guarded against user tampering. Simultaneously, EROS enables users to run untrusted utility software, hand private or proprietary data to that software, and be assured (within reason) that the data cannot be disclosed to the out­ side world. This paper gives a general overview of the EROS system and what it can do. The EROS research project has now ended. Further work based on the EROS system is being pursued under the CapROS project (www.capros.org). The EROS team has moved on to a successor system: Coyotos (www.coyotos.org). 1 Introduction in other publications. Others result from chains of reasoning that are omitted for reasons of space. A This paper accompanies a talk for the 2005 Libre few are opinions derived from years of in-depth Software Meeting in Dijon, France. Since it seems experience with a range of operating systems. In likely that this will be the last non-academic publi­ an academic paper these statements would be inap­ cation on the EROS system, it has emerged as a propriate, but this paper is not aimed at an academ­ curiously informal mix of anecdote and paper. I ic audience. wanted to provide not just a sense of what EROS The EROS system is slowly taking on a life of its can do, but also a sense of its history and rationale. own. EROS is having significant influence on the In this paper I will try to describe how the EROS successor to the current L4 system, which is on its project got started, what is different and significant way to being a pure, capability-based nucleus. The about the system, and why EROS or its successor EROS code base itself has now been taken over by might be interesting as a secure operating system Charlie Landau under the CapROS project (www.­ platform for future applications. capros.org). This seems fitting, since Charlie was EROS is a difficult system to get your head one of the original KeyKOS architects. My own around, because it challenges many of the accepted wisdoms of conventional operating system design. Trying to approach this system by asking how it is Copyright 2005, Jonathan S. Shapiro. like other systems that you may know is often a Verbatim copying and distribution of this document in frustrating exercise. EROS is simply different. any medium are permitted without royalty or fee, pro­ One note to academic readers: there are some con­ vided that this copyright notice is preserved. clusions stated in this paper that are neither sub­ This paper was first published as part of the Libre Soft­ stantiated nor explained here. Some are addressed ware Meeting, Dijon, France, July 5-9, 2005 1 work has turned to a high-assurance successor sys­ sition from selling 7 copies of the system at $1 tem called Coyotos (www.coyotos.org). million each to selling 1 million copies at $7 As a research system, EROS has met essentially each.º all of the goals that we set for it. Minor changes My first introduction to KeyKOS came through a will be needed to move it into production use, but talk given by Norm Hardy at Stanford University these do not appear to be especially difficult. in 1989. Two years later I encountered it again as one of the founders of HaL Computer Systems. 2 How the EROS Project Started We briefly considered acquiring Key Logic, which had a strong engineering team and an extremely Like the LINUX system, EROS started its life as robust implementation. HaL©s goal was to deliver a an attempt to provide an open source reverse engi­ top to bottom line of systems that would be based neering of an existing operating system: KeyKOS. on open software standards, but would provide the Since there is a useful business lesson in it for oth­ kinds of reliability that IBM customers had come er open source projects, I©ll give a brief history to count on. To put some perspective on this, here. there is no UNIX-based system today (2005) that delivers the level of reliability routinely achieved 2.1 GNOSIS and KeyKOS by KeyKOS on less reliable hardware in 1990. As HaL©s manager of software design and one of the The GNOSIS project was started by Tymshare, founders, I was extensively involved in evaluating Inc. in 1972. The system first ran commercial ap­ the KeyKOS system. plications in 1983. For history fans, 1983 was also the year that UNIX System V and the 4.2 BSD Two conclusions came out of that evaluation: UNIX systems released. The Tymshare system was named originally named GNOSIS (ªGreat Cary Liu, our manager for the operating system New Operating System In the Skyº1), and the key group, felt strongly that HaL would be better technical contributors were Norm Hardy, Charlie served by porting UNIX System V Release 4, a Landau, Bill Frantz, Alan Bomberger, and Susan system that he had extensive experience with. Rajunas. There is a paper describing the architec­ Among other issues, Cary felt that he could hire ture of this system.2 It is definitely a contender for developers to work on it who already knew the the title of ªdensest piece of technical writing ever code base, and that this was critical to HaL©s crafted in the history of computing.º chances of success. In 1985, the GNOSIS system was spun out into a I concluded that KeyKOS was far better than new company called Key Logic, Inc., and the sys­ anything else I had seen, including SVR4. tem©s name changed to KeyKOS. Key Logic was Which is kind of ironic in hindsight, because I funded by Omron, Inc. to create a robust, secure had been the lead person in instigating the operating system for the Luna 88K line of work­ MIPS Application Binary Interface for SVR4 stations. The technical effort was completed just in while at Silicon Graphics, and I had come to time for Omron to abandon the workstation busi­ SGI from the language tools group at AT&T ness. Following this misfortune, Key Logic proved Bell Laboratories (home of SVR4). unable to make the transition to a world of com­ modity PCs, and ceased operations in 1990 after I should add that Cary was absolutely right about meeting every technical challenge they set out to this decision. Among other factors, HaL©s global address. As it was described to me at the time, they deployment partners were all committed to SVR4 were ªunable to make the necessary business tran­ as a software platform in some form, and transi­ tioning them to another operating system, no mat­ 1 The names ªGNOSISº and ªEROSº are a fairly convincing ter how compelling, would probably have been demonstration that technical people should not make impor­ impossible. tant marketing decisions. 2 See http://www.cis.upenn.edu/~KeyKOS/, in particular The There are two business lessons here. The first is KeyKOS Architecture. that managing a technology through a market dis­ 2 ruption (the introduction of the PC and the work­ of anything unpublished or proprietary. Which station) is extremely difficult under the best of cir­ was how EROS really got started. After a year of cumstances. In hindsight, it©s clear that KeyKOS part-time effort, EROS version 0.1 booted success­ went after the wrong niche. You don©t succeed in a fully on an i386 machine in early 1992, just in technology business by taking on an entrenched time to teach me about what happens when you competitor in an established market first. have a total hard disk failure and no backups. I ­ The second lesson is that Key Logic made several took a year out to recover by negotiating and man ­ critical mistakes in their financing. Tom O©Rourke, aging the spin out of the Xanadu Operating Com pany from Autodesk, which is an adventure for an­ who had also been the founder and CEO at 4 Tymshare, had learned how to start and run a com­ other paper some day. pany in a different generation, and I think he may not have realized just how much the world had 2.3 The Penn Years changed and how cut-throat the industry would Needing to recover from my recovery, I decided to ­ turn out to be during the 1990s. He needed multi return to school, and entered the PhD program at ple backers who were willing to play for high the University of Pennsylvania. Inevitably, the stakes and force him to articulate a viable business EROS project came with me. By this point some model. What he got was a single, conservative, questions had emerged in my mind about corporate investor that decided the stakes were too KeyKOS. The main issue concerned a claim that high, and backed out of the entire industry just as we had made in a paper entitled The KeyKOS it was becoming really interesting.