Home
QNX Software Development Platform
QNX SDP is a cross-compiling and debugging environment, including an IDE and command-line tools, for building binary images and programs for target boards running the QNX OS 8.0.
System Security Guide
The QNX System Security Guide is intended for both system integrators who are responsible for the security of a QNX OS system and developers who want to create a QNX OS resource manager free from vulnerabilities.
Security Features for Developers
Stack protection
Stack cookies provide protection against stack buffer overflow on stack-allocated variables, which prevents program misbehaviours.

QNX Momentics IDE User's Guide
This User's Guide describes version 8.0 of the Integrated Development Environment (IDE) that's part of the QNX Tool Suite.
QNX Software Development Platform
QNX SDP is a cross-compiling and debugging environment, including an IDE and command-line tools, for building binary images and programs for target boards running the QNX OS 8.0.
- Quickstart Guide
- System Architecture
  The System Architecture guide accompanies the QNX OS and is intended for both application developers and end-users.
- OS Components & Operations
- Graphics
- Programming
- System Security Guide
  The QNX System Security Guide is intended for both system integrators who are responsible for the security of a QNX OS system and developers who want to create a QNX OS resource manager free from vulnerabilities.
  - Security Matrix
    The following table describes security problems and cyberattacks and the QNX OS security features that can mitigate them.
  - Security Features Overview
  - Security Features for Developers
    - Security policies
      Security policies can make some aspects of security much easier for a developer.
    - Stack protection
      Stack cookies provide protection against stack buffer overflow on stack-allocated variables, which prevents program misbehaviours.
    - RELRO
    - Compiler defenses
    - Address space layout randomization (ASLR)
      Address space layout randomization varies the location of data and instructions each time an executable is loaded.
    - Fortified system functions
      QNX OS fortified system functions are designed to detect out-of-bounds memory accesses by performing lightweight parameter validation at compile-time, runtime, or both.
    - Cryptography for developers
      QNX OS offers developers many alternatives for cryptography functions.
    - Random number generation
    - Permission checking
    - Hypervisor security
      Because the QNX hypervisor is built as an extension of the QNX OS microkernel, it inherits the security features of the microkernel itself as well as the secure execution environment the microkernel creates. It also has additional layers that are purpose built for secure virtual machine operation.
    - Writing a resource manager
      The information in this section is designed to help you create a QNX OS resource manager that does not contain vulnerabilities. It focuses on properly checking both permissions and the length and content of resource manager messages.
  - Security Features for System Integrators
  - Security Policies
  - Fortified System Functions
  - QNX Cryptography Library
    The QNX cryptography library (qcrypto library) is a generic cryptographic shim layer that provides a consistent API to the various cryptographic primitives offered by third-party libraries.
  - The devcrypto service
    The devcrypto service is a legacy system driver interface and is mainly provided for backwards compatibility.
  - Pathtrust
    The pathtrust feature prevents processes from executing untrusted code. If a process is compromised, pathtrust mitigates the threat of the system being further compromised by an attacker using chained-together exploits.
  - PAM
    Systems that need authentication can use pluggable authentication module (PAM), a configurable standard library.
  - Using mkqnximage to Display Security Features
- Utilities & Libraries
- Migrating to QNX OS 8.0
QNX Software in the Cloud
QNX Software in the Cloud enables developers to use the QNX OS in the Amazon cloud environment.
QNX Toolkit for Visual Studio Code
This User's Guide describes the QNX^® Toolkit for Visual Studio Code. The guide introduces you to the QNX Toolkit by explaining the QNX development environment and how to build, run, and debug your QNX^® Operating System (OS) applications and systems.
QNX Hypervisor User's Guide
This User's Guide explains the QNX hypervisor architecture and provides instructions for installing and running a QNX Hypervisor system, changing system components and configuration, and using hypervisor features such as virtual devices (vdevs).
Typographical Conventions, Support, and Licensing
This section describes the typographical conventions used throughout the documentation, explains how to obtain technical support, and provides some information about licensing.

Stack protection

QNX SDP8.0QNX OS System Security GuideAPIConfiguration

Stack cookies provide protection against stack buffer overflow on stack-allocated variables, which prevents program misbehaviours.

They are enabled by any of the following compiler options:

-fstack-protector: Protects any function that declares a character array of eight bytes or more in length on its stack.
-fstack-protector-all: Protects all functions.
-fstack-protector-strong: Balanced between -fstack-protector and -fstack-protector-all, the purpose of this option is to gain performance while sacrificing little security by broadening the scope of the stack protection without extending it to every function in the program.

By default, qcc implicitly uses the -fstack-protector-strong option. However, when you directly invoke either ntoaarch64-gcc or ntox86_64-gcc, -fstack-protector-strong is not implicitly used.

In addition, qcc does not implicitly use -fstack-protector-strong when you specify any of the following compiler or linker options:

-fno-stack-protector
-fstack-protector
-fstack-protector-all
-ffreestanding
-nostdlib

Binaries built for QNX OS are built with a non-executable stack by default. The stack’s executable state is found in a QNX-specific ELF note of type QNT_STACK.

The following example command checks the executable state of the less utility:

$ elfnote -t QNT_STACK -p less 

QNX specific note (name = QNX, type = 3) 
type : QNT_STACK 
stacksize : 0 
stackalloc : 4096 
executable : no 
hex : 000000000010000001000000

For more information on QNX OS note types, see the elfnote entry in the Utilities Reference.

You can use the qchecksec utility to determine both whether stack cookies are enabled for a binary and a stack's executable state. See the qchecksec entry in the Utilities Reference.

Page updated: March 05, 2025