Security
• A self-protecting Trusted Computing Base (TCB) guarantees enough system integrity to implement features such as multiple users and key storage.
• Strong process isolation using virtual memory ensures that the kernel is protected from user code, and that user processes are protected from one another
• Identification and instrumentation of security-relevant operations throughout the kernel to implement access control, resource limits, and event auditing
• A coherent privilege model, internal to the kernel, that allows exceptional operations (such as system administration, device-driver implementations) to occur in a structured way despite being outside the regular access-control model