Home
QNX Software Development Platform
QNX SDP is a cross-compiling and debugging environment, including an IDE and command-line tools, for building binary images and programs for target boards running the QNX OS 8.0.
System Security Guide
The QNX System Security Guide is intended for both system integrators who are responsible for the security of a QNX OS system and developers who want to create a QNX OS resource manager free from vulnerabilities.
Security Features for System Integrators
Application groups
Application groups are used to group processes together so they can be controlled as a group.

QNX Momentics IDE User's Guide
This User's Guide describes version 8.0 of the Integrated Development Environment (IDE) that's part of the QNX Tool Suite.
QNX Software Development Platform
QNX SDP is a cross-compiling and debugging environment, including an IDE and command-line tools, for building binary images and programs for target boards running the QNX OS 8.0.
- Quickstart Guide
- System Architecture
  The System Architecture guide accompanies the QNX OS and is intended for both application developers and end-users.
- OS Components & Operations
- Graphics
- Programming
- System Security Guide
  The QNX System Security Guide is intended for both system integrators who are responsible for the security of a QNX OS system and developers who want to create a QNX OS resource manager free from vulnerabilities.
  - Security Matrix
    The following table describes security problems and cyberattacks and the QNX OS security features that can mitigate them.
  - Security Features Overview
  - Security Features for Developers
  - Security Features for System Integrators
    - Privilege control
    - Systems without passwords
    - Secure boot
      Secure boot is a mechanism that ensures the integrity of the running system, by cryptographically verifying each stage of the boot process.
    - Cryptography for system integrators
      QNX OS supports multiple ways to access cryptography services.
    - Address space layout randomization (ASLR)
      Address space layout randomization varies the location of data and instructions each time an executable is loaded as long as it was compiled with Position-Independent Executable (PIE) support.
    - Fortified system functions
      QNX OS fortified system functions are designed to detect out-of-bounds memory accesses by performing lightweight parameter validation at compile-time, runtime, or both.
    - Access control
      Access control is the selective restriction of access to a resource. Access controls take many different forms and the sections below describe which ones can be used in QNX OS systems.
    - Filesystem security
    - Random number generation
    - Virtualization security features
      Virtual devices (vdevs) provided by QNX Hypervisor for Safety (QHS) and other QNX hypervisors.
    - The /proc filesystem
    - Application groups
      Application groups are used to group processes together so they can be controlled as a group.
    - Hypervisor security
      The QNX hypervisor is built as an extension of the QNX OS microkernel. As such, it inherits the security features of the microkernel itself as well as the secure execution environment created by the microkernel. In addition, the hypervisor has additional layers that are purpose-built for secure virtual machine operation.
  - Security Policies
  - Fortified System Functions
  - QNX Cryptography Library
    The QNX cryptography library (qcrypto library) is a generic cryptographic shim layer that provides a consistent API to the various cryptographic primitives offered by third-party libraries.
  - The devcrypto service
    The devcrypto service is a legacy system driver interface and is mainly provided for backwards compatibility.
  - Pathtrust
    The pathtrust feature prevents processes from executing untrusted code. If a process is compromised, pathtrust mitigates the threat of the system being further compromised by an attacker using chained-together exploits.
  - PAM
    Systems that need authentication can use pluggable authentication module (PAM), a configurable standard library.
  - Using mkqnximage to Display Security Features
- Utilities & Libraries
- Migrating to QNX OS 8.0
QNX Software in the Cloud
QNX Toolkit for Visual Studio Code
This User's Guide describes the QNX^® Toolkit for Visual Studio Code. The guide introduces you to the QNX Toolkit by explaining the QNX development environment and how to build, run, and debug your QNX^® Operating System (OS) applications and systems.
Typographical Conventions, Support, and Licensing
This section describes the typographical conventions used throughout the documentation, explains how to obtain technical support, and provides some information about licensing.

Application groups

QNX SDP8.0QNX OS System Security GuideAPIConfiguration

Application groups are used to group processes together so they can be controlled as a group.

Application groups rely on every process having its own ID, known as an "application ID". The application ID can be used for operations, such as delivering signals.

A new application group can be formed during the spawning of a process. By default, the application ID of this process matches that of its parent. If the spawn flag POSIX_SPAWN_NEWAPP is specified when the process starts, the process instead creates a new application group with the application ID matching the process ID of the new process. The use of the spawn flag is privileged, requiring that the process calling posix_spawn() has the ability PROCMGR_AID_CHILD_NEWAPP. Simply put, an adequately privileged process can create a child process where all of its descendants in addition to itself share the same application ID, making an application group. This allows for all processes in the application group to be terminated. For more information, see posix_spawn() in the C Library Reference.

The DCMD_PROC_INFO devctl() returns the application ID in a structure field.

Operations which may be performed using application IDs include:

Using SIG_APPID with SignalKill() to send signals to the group. SignalKill() accepts SIG_APPID ORed into the signal number parameter, which sends the signal to all the processes with an application ID that matches the pid argument (see SignalKill() in the C Library Reference)
Suspending and continuing processes using the SchedCtl() function with the SCHED_STOP_APP and SCHED_CONT_APP commands (see SchedCtl() in the C Library Reference)

Page updated: August 09, 2024