The Gatekeeper  Multics tries hard to prevent the confused deputy problem…  The gatekeeper carefully (!) checks the parameters passed when privilege increases  The gatekeeper sometimes copies code to avoid giving a whole segment of the caller to the callee  The kernel is split between Ring 0 and 1 – the gatekeeper is Ring 0
{}