Software capabilities are a very convenient means to protect co-operating applications. They allow access rights to be dynamically exchanged between mutually suspicious interacting applications. However in all the proposed approaches, capabilities are made available at the programming language level, requiring application developers to wire protection definition in the application code, which is detrimental to both flexibility and reusability. We believe instead that capabilities should be hidden from the application programmer allowing protection definition and application code to be clearly separated. In this paper we propose a new protection model based on hidden software capabilities, in which protection definition is completely disjoined from the application code and described in an extended interface definition language (IDL). This allows to specify protection for existing modules and to easily change the protection policy of an application. This protection model can be integrated in a wide range of operating systems. We are currently implementing it in a single address space operating system based on distributed shared memory.

The design and the architecture of the management service in the Guide object-oriented distributed system is presented. First, we discuss general problems of distributed system management. Then we propose the use of persistent objects to specify system, configuration and the different interfaces these objects need to bind in order to allow the control and the monitoring of managed entities. After that we discuss the need for several levels of representation of management information. And finally we discuss the use of database services and data replication to ensure the availability, the reliability, and the consistency of these objects.

The purpose of the Guide project is to explore the use of shared objects for communication in a distributed system, especially for applications that require cooperative work. Since 1986, two prototypes have been implemented respectively on top of Unix (Guide-1) and Mach 3.0 (Guide-2). They have been used for the development of distributed cooperative applications, allowing us to validate or reject many design choices in the system.

This paper presents an overview of the Comandos distributed application platform. It begins by presenting the scope and objectives of the platform before introducing its main concepts, design choices and overall architecture. An overview of the various prototype implementations of the platform undertaken within the Comandos project is also presented. In addition, the paper provides an introduction to the other papers on Comandos in this issue and sets the context for the research reported therein.

A mechanism for synchronizing shared objects in a distributed system based on persistent, typed objects is presented. Synchronization constraints are expressed as separate control clauses and are factorized for a class of objects. The interference of this mechanism with inheritance and transactions is examined and solutions are proposed. Examples of synchronized objects are provided, and a semaphore-based implementation of the mechanism is described.>