Home
QNX Software Development Platform
QNX SDP is a cross-compiling and debugging environment, including an IDE and command-line tools, for building binary images and programs for target boards running the QNX OS 8.0.
System Security Guide
The QNX System Security Guide is intended for both system integrators who are responsible for the security of a QNX OS system and developers who want to create a QNX OS resource manager free from vulnerabilities.
Security Policies
The libsecpol API (secpol.h)
The libsecpol library API provides functions for systems that use security policies.
set_ids_from_arg()
Change the caller's identifiers based on a given string

QNX Momentics IDE User's Guide
This User's Guide describes version 8.0 of the Integrated Development Environment (IDE) that's part of the QNX Tool Suite.
QNX Software Development Platform
QNX SDP is a cross-compiling and debugging environment, including an IDE and command-line tools, for building binary images and programs for target boards running the QNX OS 8.0.
- Quickstart Guide
- System Architecture
  The System Architecture guide accompanies the QNX OS and is intended for both application developers and end-users.
- OS Components & Operations
- Graphics
- Programming
- System Security Guide
  The QNX System Security Guide is intended for both system integrators who are responsible for the security of a QNX OS system and developers who want to create a QNX OS resource manager free from vulnerabilities.
  - Security Matrix
    The following table describes security problems and cyberattacks and the QNX OS security features that can mitigate them.
  - Security Features Overview
  - Security Features for Developers
  - Security Features for System Integrators
  - Security Policies
    - Using security policies
    - Security policy language
    - Named range file
    - Tutorial: Build a system that uses a security policy
      The steps for developing a QNX OS system that uses a security policy include adding security types and generating a policy using the secpolgenerate utility.
    - The libsecpol API (secpol.h)
      The libsecpol library API provides functions for systems that use security policies.
      - Specifying the security policy file handle
        For convenience, the API functions that specify a handle to the security policy file allow you to specify NULL for handle.
      - Checking custom permissions when no policy is used
      - Customizing permissions using a security policy
        The secpol_get_permission() and secpol_check_permission() functions allow you to support fine-grained permission checking in a system that uses security policies.
      - get_ids_from_arg()
        Get identifiers from an argument string, or the string and /etc/passwd and /etc/group
      - secpol_check_permission()
        Check if a requesting process has a specified permission
      - secpol_close()
        Close the security policy file
      - secpol_flags_e
        Flags for secpol_transition_type(), secpol_posix_spawnattr_settypeid() and secpol_resolve_name()
      - secpol_get_permission()
        Returns a handle to a permission associated with a custom class
      - secpol_get_permission_flags_e
        Flags for secpol_get_permission()
      - secpol_get_policy_id()
        Return the policy ID of any policy that has been pushed to procnto
      - secpol_get_type_id()
        Return the type ID associated with a type name
      - secpol_get_type_name()
        Return the type name associated with a type ID
      - secpol_open()
        Open a security policy file
      - secpol_open_flags_e
        Flags for secpol_open()
      - secpol_posix_spawnattr_settypeid()
        Update a spawn attribute object to spawn a child with a different type
      - secpol_resmgr_attach()
        Attach a path to the pathname space with permissions set via a security policy
      - secpol_resolve_name()
        Resolve a type name to a type ID
      - secpol_transition_type()
        Transition to a new type
      - secpol_type_id()
        Return the type ID of the process
      - set_ids_from_arg()
        Change the caller's identifiers based on a given string
  - Fortified System Functions
  - QNX Cryptography Library
    The QNX cryptography library (qcrypto library) is a generic cryptographic shim layer that provides a consistent API to the various cryptographic primitives offered by third-party libraries.
  - The devcrypto service
    The devcrypto service is a legacy system driver interface and is mainly provided for backwards compatibility.
  - Pathtrust
    The pathtrust feature prevents processes from executing untrusted code. If a process is compromised, pathtrust mitigates the threat of the system being further compromised by an attacker using chained-together exploits.
  - PAM
    Systems that need authentication can use pluggable authentication module (PAM), a configurable standard library.
  - Using mkqnximage to Display Security Features
- Utilities & Libraries
- Migrating to QNX OS 8.0
QNX Software in the Cloud
QNX Toolkit for Visual Studio Code
This User's Guide describes the QNX^® Toolkit for Visual Studio Code. The guide introduces you to the QNX Toolkit by explaining the QNX development environment and how to build, run, and debug your QNX^® Operating System (OS) applications and systems.
Typographical Conventions, Support, and Licensing
This section describes the typographical conventions used throughout the documentation, explains how to obtain technical support, and provides some information about licensing.

set_ids_from_arg()

QNX SDP8.0QNX OS System Security GuideAPIConfiguration

Change the caller's identifiers based on a given string

Synopsis:

#include <secpol/ids.h>

int set_ids_from_arg(const char *arg)

Arguments:

arg: The formatted string containing the ID information.

Library:

libsecpol

Description:

The set_ids_from_arg() function sets the returned user ID, group ID, and supplementary group IDs.

This function doesn't support negative IDs.

The arg string format can take one of the following two forms:

UID
```
uid:gid,sgid1,sgid2,sgid3,... 
```
All IDs must be numbers. The UID and GID are separated by a colon. The GID can be followed by a comma-separated list of supplementary group IDs. If the GID is not specified, the GID of the calling process is returned. The supplementary GIDs are also optional. *
Username
```
username,sgid1,sgid2,sgid3,... 
```
The username must be a valid username defined in /etc/passwd; otherwise, the function errors out with EINVAL. The supplementary GIDs are optional and must be a comma-separated list of numbers. The GID is looked up in /etc/passwd. The supplementary GIDs returned are a union of the supplementary GIDs in /etc/group for the given username and the GIDs parsed from arg.

See also get_ids_from_arg().

Returns:

EOK on success; on failure, -1 and errno is set to one of the following values:

EINVAL - The argument is in an invalid format or references a non-existent username.
ERANGE - An ID in the argument is larger than the uid_t or gid_t data type supports.
E2BIG - The system can't support the number of supplementary GIDs specified in the argument.
EPERM - The calling process does not have the required permissions to set IDs.

Page updated: August 09, 2024