0

Multi-user OSes are nothing special. Normally one user cannot access the files of another user. Installed programs are shared. User's are running in a sandbox and they're isolated from other users.

Isolated programs are not that common. It forbids one program to access the files of another program.

Imagine you are using a web browser and you're also storing passwords for websites (so you do not have to enter them again). The passwords are stored obfuscated but unencrypted in a local file in your home directory. Now when you run a game (downloaded from the internet) it can normally read all your passwords. (AFAIK this is still the case for modern browsers today if you are not using a master password.)

On smartphones (Android + iOS) this is different (and in my opinion better). Apps cannot read the files and settings of other apps. Because apps are isolated it's also possible to restrict other permissions like camera access or access to your geographical location.

Which was the first OS having both user and program isolation? At least programs must not have been able to read files of other programs. Also note it must have been possible without modifying the OS, changing configuration files or installing tools.

Also note that the answer "every multi-user OS can be used to isolate programs" does not count. Because to be a valid answer the OS has to be used in a normal way. Manually creating a user for each program on Windows or Debian means the OS is not used in a normal way.

To meet the condition for being a multi-user OS it must be possible for multiple real persons to use one single device (every person has its own user). Also each user must have his own settings for each program (because the settings are stored in the user's home directory for example).

I am looking for all kind of OSes (not only desktop).

Improve this question
2
  • Comments have been moved to chat; please do not continue the discussion here. Before posting a comment below this one, please review the purposes of comments. Comments that do not request clarification or suggest improvements usually belong as an answer, on Retrocomputing Meta, or in Retrocomputing Chat. Comments continuing discussion may be removed.
    – Chenmunka ♦
    Feb 4 at 13:49
  • Suppose we change the spelling of "user id" to "program id", without changing the underlying implementation, Presto, we've solved the problem, right?
    – another-dave
    Feb 5 at 2:36

2 Answers 2

Reset to default
7

I would suggest CTSS (1961), which I believe isolated users/programs by swapping jobs in and out of memory rather than paging.

This built on earlier batched systems which had implicit separation since each program ran sequentially, hence there was no interaction at all between users.

Later, VM/370 allowed user programs to pass messages between themselves, which was used to implement various larger-scale networking etc.

All in all, I would suggest that "which is the first OS that allowed controlled interaction between user programs including OS-provided subsystems" would be a more interesting question.

If I may make a personal observation about the very early OSes that led up to CTSS etc. In the beginning a program, compiled or in source form, was submitted with no prefix or suffix.

At some point it became usual to load each program with prefix and/or suffix code to set up peripherals; this might or might not have included library routines for use while the program was running.

That changed to having prefix/suffix control cards, which were processed by a memory-resident monitor (not, in theory at least, overwritten or disabled by the user program).

And it was that memory-resident monitor which handled job setup, which became the in-memory OS of the early '60s with task switching one of its responsibilities.

Improve this answer
11
  • 2
    That isolates programs while they’re running, but could a program access another program’s data in storage? Note that in the question, the browser doesn’t have to be running for the game to access the (poorly-protected, which might not be accurate) passwords.
    – Stephen Kitt
    Feb 3 at 9:43
  • @StephenKitt I'm not sure, but the description I've seen suggests that every active user had his own storage device and this was what was used for the swapping. Early timeshaing was /slow/: even something like a B5500 (1964ish) only had around one tick per second (if I recall correctly).
    – Mark Morgan Lloyd
    Feb 3 at 9:46
  • 1
    Ah yes, in very early versions of CTSS, “We did not have any disk storage, so we took advantage of the fact that it was a large machine and we had a lot of tape drives. We assigned one tape drive per typewriter.” (Rosin and Lee, The CTSS Interviews, in Annals of the History of Computing 14, 1992.) Thus storage was separate, at least in that version.
    – Stephen Kitt
    Feb 3 at 12:14
  • 1
    @StephenKitt thinking about your original point: programs/users on a 7000-series machine could probably have found some way of accessing each others peripherals, but it would hardly have been an "officially sanctioned" interface. My understanding is that IBM mainframes relied on "security by obscurity" well into the MVS era, at which point they had a massive exercise tightening things up (sorry, I've lost the reference to that). I'm not necessarily saying that their competitors were much better, although it might have taken more stages and a modicum of social engineering to really break things
    – Mark Morgan Lloyd
    Feb 3 at 13:27
  • 2
    What is the technical basis on which you distinguish 'system services' (when said services, such as Apache are not part of the operating system) from 'user programs'?
    – another-dave
    Feb 3 at 23:53
5

Maybe not the first, but the Titan Supervisor (1963, Cambridge University) came close.

Timesharing.
Interactive access.
Access control system.

Most notably, the access control lists on objects allowed one to grant or deny access to programs as well as users. This I think is the crux of your question, right?

The filing system, designed by A.G. Fraser, was very similar to that of the CTSS, though with considerably more flexible arrangements for access control. In particular it was possible to use the identity of a program as a parameter for access control decisions as well as or instead of the identity of the user, a feature which Cambridge people have ever since regarded as strange to omit.

IEEE biography of M.V.Wilkes

Titan was the prototype for a system sold commerically as the Ferranti Atlas 2. It was essentially 'Atlas without the virtual memory', i.e. a cheaper machine - a steal at only a million pounds or so. It was not a desktop system.

The (bundled) supervisor thus has some claim to be the first timesharing system delivered commercially.

Improve this answer
3
  • so, "atlas without the virtual memory" - then, perhaps it was Atlas that was first? VM, concurrent programs running, completed in 1962 but started earlier? history-computer.com/atlas-computer - but, wow, great find, especially a site where they're putting documents online!
    – davidbak
    Feb 4 at 17:58
  • I don't think so; the access-control scheme is a property of the OS, and the Titan Supervisor (written at Cambridge) is not as far as I can tell based on the earlier Atlas Supervisor (written at Manchester). And my guess is that file protection only gets to be interesting when you have online shared storage (i.e., disks with file systems). My assumption, of course, is that the OP is asking about protection of persistent data, not address spaces. I accept that magtapes probably are a grey area.
    – another-dave
    Feb 4 at 18:17
  • I agree with another-dave, the Atlas didn’t have shared storage (programs couldn’t arbitrarily access each others’ input or output) so it doesn’t meet zomega’s requirements.
    – Stephen Kitt
    Feb 4 at 21:54

Not the answer you're looking for? Browse other questions tagged .