From my understanding of your paragraphs about "privilege model" and "file systems", Genode is a candidate you may have a look at: http://genode.org/documentation/general-overview/