Lightweight Capability Domains : Decomposing the Linux Kernel
Tolerating malicious device drivers in Linux