zlacker

Sandboxing, where each process is only allowed to use a precise set of system resources.

Any attempt to use anything else leads to termination.

>>pjmlp+(OP)
Which resources are they allowed to use? What defines which resources they are given?

>>Touche+V8
> Which resources are they allowed to use?

The system administrator at installation time.

> What defines which resources they are given?

Applications just have a request list of what they require.

If the administrator doesn't allow them for the given application modules (executable, dynamic library, function call,...), bad luck.