Appendix: Security Policies

This section describes the enforcement of security policies on the host for isolating and controlling container processes

When considering isolation of container processes, the QNX Containers implementation provides a sandboxed network environment and a chroot filesystem.

Security policies provide a fine-grained method of controlling process abilities, which can limit the abilities of a process in a container, or host processes in general.

For more information on security policies and how to generate them. refer to the chapter Security Policies of the QNX System Security Guide at https://www.qnx.com/developers/docs/8.0/com.qnx.doc.security.system/topic/manual/security_policies.html

Security policies is also discussed in the QNX Containers Cybersecurity Manual.

Minimal Security Policy Rules

The processes qrunc and qcmgr must run as root due to the amount privileged operations they need to perform. However, they don't require all of the abilities that root can perform. Security policies allow you to tightly limit and control a given process, even while running as a privileged user. Also to make the security policy enforcement effective, the container processes shouldn't be run as a privileged user like root unless absolutely required by your container application. You may also wish to define a different security policy type for each of your containers.