Home
QNX Software Development Platform
QNX SDP is a cross-compiling and debugging environment, including an IDE and command-line tools, for building binary images and programs for target boards running the QNX OS 8.0.
System Security Guide
The QNX System Security Guide is intended for both system integrators who are responsible for the security of a QNX OS system and developers who want to create a QNX OS resource manager free from vulnerabilities.
Security Policies
Tutorial: Build a system that uses a security policy
The steps for developing a QNX OS system that uses a security policy include adding security types and generating a policy using the secpolgenerate utility.
Security policy maintenance
Maintenance tasks for your security policy can include determining whether any generated rules should be edited or removed, manually editing policies for efficiency and simplicity, and reviewing the contents of /dev/secpolgenerate/unused.

QNX Momentics IDE User's Guide
This User's Guide describes version 8.0 of the Integrated Development Environment (IDE) that's part of the QNX Tool Suite.
QNX Software Development Platform
QNX SDP is a cross-compiling and debugging environment, including an IDE and command-line tools, for building binary images and programs for target boards running the QNX OS 8.0.
- Quickstart Guide
- System Architecture
  The System Architecture guide accompanies the QNX OS and is intended for both application developers and end-users.
- OS Components & Operations
- Graphics
- Programming
- System Security Guide
  The QNX System Security Guide is intended for both system integrators who are responsible for the security of a QNX OS system and developers who want to create a QNX OS resource manager free from vulnerabilities.
  - Security Matrix
    The following table describes security problems and cyberattacks and the QNX OS security features that can mitigate them.
  - Security Features Overview
  - Security Features for Developers
  - Security Features for System Integrators
  - Security Policies
    - Using security policies
    - Security policy language
    - Named range file
    - Monitoring security policy events
    - Tutorial: Build a system that uses a security policy
      The steps for developing a QNX OS system that uses a security policy include adding security types and generating a policy using the secpolgenerate utility.
      - Setting up a system to use security types
        Before you can generate or apply a security policy, you need to specify a type for each process in your system.
      - Booting the system for the first time
        After you add security types to your system, a security policy is required to boot it. The secpolgenerate utility provides an easy method for creating this policy.
      - The generated security policy
        The generated security policy contains a set of rules that describes the abilities that processes used and where they attached themselves in the path space, as observed by secpolgenerate.
      - Compiling the security policy
        You compile the security policy provided by secpolgenerate using the secpolcompile utility.
      - Booting securely
        To boot the system securely, remove the lines that run secpolgenerate from the startup script, rebuild the OS image, and reboot.
      - Developing systems with a security policy
        In most development environments, security policies will need to be revised or updated. For example, your initial attempt at a policy may not account for all desired behavior, or you might add a new program or new version of a program. Although you can capture any new rules that are required by running secpolgenerate again in an unrestricted manner, in most cases it's better to selectively remove restrictions using the configuration file.
      - The error file
        The secpolgenerate utility provides the file /dev/secpolgenerate/errors to help you debug broken systems.
      - System monitoring using secpolgenerate
        In addition to development tasks, you can use secpolgenerate in a secure, deployed system to detect errors.
      - Security policy maintenance
        Maintenance tasks for your security policy can include determining whether any generated rules should be edited or removed, manually editing policies for efficiency and simplicity, and reviewing the contents of /dev/secpolgenerate/unused.
      - Reviewing for unnecessary rules
        Although secpolgenerate generates policy rules based on what was needed when the system was run, it's likely not all the rules are appropriate. QNX recommends that you review the security policy specifically to locate processes with abilities that they don't need.
      - State and event files
        The secpolgenerate utility uses files called state and event files to represent the successful or failed use of abilities and paths by processes according to their type.
      - Troubleshooting and frequently asked questions
    - The libsecpol API (secpol.h)
      The libsecpol library API provides functions for systems that use security policies.
    - The libsecpolev API (libsecpolev.h)
      The libsecpolev library API provides functions that allow a program to monitor system trace events that relate to the successful or failed use of privileges covered by security policies.
  - Fortified System Functions
  - QNX Cryptography Library
    The QNX cryptography library (qcrypto library) is a generic cryptographic shim layer that provides a consistent API to the various cryptographic primitives offered by third-party libraries.
  - The devcrypto service
    The devcrypto service is a legacy system driver interface and is mainly provided for backwards compatibility.
  - Pathtrust
    The pathtrust feature prevents processes from executing untrusted code. If a process is compromised, pathtrust mitigates the threat of the system being further compromised by an attacker using chained-together exploits.
  - PAM
    Systems that need authentication can use pluggable authentication module (PAM), a configurable standard library.
  - Using mkqnximage to Display Security Features
- Utilities & Libraries
- Migrating to QNX OS 8.0
QNX Software in the Cloud
QNX Software in the Cloud enables developers to use the QNX OS in the Amazon cloud environment.
QNX Toolkit for Visual Studio Code
This User's Guide describes the QNX^® Toolkit for Visual Studio Code. The guide introduces you to the QNX Toolkit by explaining the QNX development environment and how to build, run, and debug your QNX^® Operating System (OS) applications and systems.
QNX Hypervisor User's Guide
This User's Guide explains the QNX hypervisor architecture and provides instructions for installing and running a QNX Hypervisor system, changing system components and configuration, and using hypervisor features such as virtual devices (vdevs).
Typographical Conventions, Support, and Licensing
This section describes the typographical conventions used throughout the documentation, explains how to obtain technical support, and provides some information about licensing.

Security policy maintenance

QNX SDP8.0QNX OS System Security GuideAPIConfiguration

Maintenance tasks for your security policy can include determining whether any generated rules should be edited or removed, manually editing policies for efficiency and simplicity, and reviewing the contents of /dev/secpolgenerate/unused.

The secpolgenerate utility is not designed to generate a security policy that you can use as is. Rather, it is intended to provide input into a policy that you modify based on the actual needs of the system. For example, in some cases, the rules for programs like dumper need to change to allow it to function.

It is also possible to use the automatically generated policy only as a guide for producing policies that are equivalent to but better than ones that secpolgenerate produces. For example, you can use attributes in the security policy language to group related sets of capabilities and assign them to types.

In other cases, you can rewrite rules to improve them. For example, the following rule is a candidate for simplification:

allow_attach devc_pty_t {
    /dev/ttyp0
    /dev/ptyp0
    /dev/ttyp1
    /dev/ptyp1
    /dev/ttyp2
    /dev/ptyp2
    /dev/ttyp3
    /dev/ptyp3
    /dev/ttyp4
    /dev/ptyp4
    /dev/ttyp5
    /dev/ptyp5
    /dev/ttyp6
    /dev/ptyp6
    /dev/ttyp7
    /dev/ptyp7
};

This rule can be replaced with the following one:

allow_attach devc_pty_t {
    /dev/ttyp*
    /dev/ptyp*
};

When the system is exercised in new ways or as new services are added and others are taken away, you need to update the policy. To perform these updates, first use secpolgenerate to remove restrictions from types to allow processes to do what they like without encountering errors (see Developing systems with a security policy). Then, use the contents of /dev/secpolgenerate/policy to determine which rules to add to the policy. In most cases, these additional rules are merged with existing rules rather than concatenated to the end of the existing policy file.

secpolgenerate also provides the file /dev/secpolgenerate/unused, which indicates rules or types that the system did not require. It can be used as a guide for rules or types to remove. However, it is important to consider why the rules are there because it is possible that they're only required under circumstances that have not yet occured.

Page updated: March 05, 2025