Authorizing Applications in Singularity

We describe a new design for authorization in operating systems in which applications are first-class entities. In this design, prin-cipals reflect application identities. Access control lists are pat-terns that recognize principals. We present a security model that embodies this design in an experimental operating system, and we describe the implementation of our design and its performance in the context of this operating system. Categories and Subject Descriptor