Security

A resource manager is usually a privileged process, so you should be careful not to let a client coerce it into exhausting resources or compromising the system.

When you're designing your resource manager, you should consider the following:

The permissions on the resource manager's entry in the pathname space

You specify these permissions as an argument to iofunc_attr_init(). In general, there isn't a correct set of permissions to use; you should restrict them according to what you want other processes and users to be able to do with your resource manager.

Running as root

A resource manager typically needs to be started by root in order to attach to the pathname space, but it's a good idea to use procmgr_ability() to retain the abilities that the resource manager needs, and then run as a non-root user. For more information, see Process privileges in the QNX OS Programmer's Guide.

Checking a client's abilities

You can make sure that a client has the appropriate abilities by calling ConnectClientInfoAble() or iofunc_client_info_able(). Both of these take as an argument a list of abilities; if the client doesn't have all the required abilities, these functions set _NTO_CI_UNABLE in the flags member of the _client_info structure.

Note:

If you've called one of these functions, iofunc_check_access() returns EACCES if _NTO_CI_UNABLE is set.

Your resource manager can create custom abilities by calling procmgr_ability_create(); a client can get identifiers for them by calling procmgr_ability_lookup(), and then call procmgr_ability() to retain them before it switches to a non-root user ID. For more information, see Creating abilities in the QNX OS Programmer's Guide. When you check a client's abilities, you can include a combination of PROCMGR_AID_* abilities and custom ones.