Primary APIs | Resource access control | Subsystem isolation mechanisms | Integrated firewall | Encrypted file systems |
SysV, POSIX | Unix, ACLs | chroot | IP Filter, IPSec VPNs, basic IDS | No |
Proprietary, POSIX environment functions available thru GNU licensed Amiga ixemul.library | No | No | ||
BSD, POSIX | Unix, ACLs, MAC | chroot, jail, MAC Partitions | IPFW2, IPFilter, PF | Yes |
SysV, POSIX | Unix, ACLs | chroot | IPFilter | No |
POSIX | Unix, ACLs, MAC | chroot, Capability-based security11, seccomp, SELinux, IPSec | Netfilter/Varied by distribution | Yes |
proprietary | Unix | Namespaces | ||
proprietary, Carbon | none | none | none | No |
Carbon, Cocoa, BSD/POSIX, X11 (since 10.3) | Unix, ACLs | chroot | ipfw | Yes |
BSD, POSIX | Unix, Veriexec | chroot, systrace | IPFilter, PF | Yes |
proprietary | Directory-enabled ACLs | Protected Address Spaces | IPFLT.NLM | Yes |
proprietary | Directory-enabled ACLs | chroot | IPFilter | Yes |
BSD, POSIX | Unix | chroot, systrace | PF | Yes |
proprietary, Unix-like | ACLs, Privileges | logical name tables | ||
proprietary | ACLs | none | none | No |
BSD, POSIX | Unix, ACLs, MAC | chroot, jail, MAC Partitions | IPFW2, IPFilter, PF | Yes |
Unix-like (and optional POSIX compatibility layer) | Unix | Namespaces | ipmux | Yes |
Windows API | ||||
Huge number of SWI calls; extensive C libraries | ||||
SysV, POSIX | Unix, RBAC, ACLs, Privileges, Trusted Extension | chroot, Containers | IPFilter | Yes |
some SysV, some POSIX, some Linux, some proprietary | Unix, Multilevel security, Biba mandatory integrity, ACLs, Privileges, subtype mechanism | Multilevel security, Biba Integrity Model, subtype mechanism | customer would have to install their own application | No |
Windows API, .NET | ACLs, Privileges, RBAC | Win32 WindowStation, Desktop, Job objects | Windows Firewall,IPSec TCP\IP Filtering | Yes |
Windows API, .NET | ACLs | Win32 WindowStation, Desktop, Job objects | Windows Firewall (XP and later), TCP\IP Filtering (NT Based systems), IPSec | Yes (NTFS Only) |
POSIX, BeOS API | Unix | none | none | No |