Home
QNX Software Development Platform
QNX SDP is a cross-compiling and debugging environment, including an IDE and command-line tools, for building binary images and programs for target boards running the QNX OS 8.0.
System Security Guide
The QNX System Security Guide is intended for both system integrators who are responsible for the security of a QNX OS system and developers who want to create a QNX OS resource manager free from vulnerabilities.
Security Policies
The libsecpol API (secpol.h)
The libsecpol library API provides functions for systems that use security policies.
secpol_check_permission()
Check if a requesting process has a specified permission

QNX Momentics IDE User's Guide
This User's Guide describes version 8.0 of the Integrated Development Environment (IDE) that's part of the QNX Tool Suite.
QNX Software Development Platform
QNX SDP is a cross-compiling and debugging environment, including an IDE and command-line tools, for building binary images and programs for target boards running the QNX OS 8.0.
- Quickstart Guide
- System Architecture
  The System Architecture guide accompanies the QNX OS and is intended for both application developers and end-users.
- OS Components & Operations
- Graphics
- Programming
- System Security Guide
  The QNX System Security Guide is intended for both system integrators who are responsible for the security of a QNX OS system and developers who want to create a QNX OS resource manager free from vulnerabilities.
  - Security Matrix
    The following table describes security problems and cyberattacks and the QNX OS security features that can mitigate them.
  - Security Features Overview
  - Security Features for Developers
  - Security Features for System Integrators
  - Security Policies
    - Implementing security policies
    - Using security policy types
    - Security policy language
    - Named range file
    - Monitoring security policy events
    - Developing systems with a security policy
      In most development environments, security policies need to be revised or updated as a project progresses. For example, your initial attempt at a policy may not account for all desired behavior, or you might add a new program or new version of a program.
    - The error file
      The secpolgenerate utility provides the file /dev/secpolgenerate/errors to help you debug broken systems.
    - System monitoring using secpolgenerate
      In addition to development tasks, you can use secpolgenerate in a secure, deployed system to detect errors.
    - Security policy maintenance
      Maintenance tasks for your security policy can include determining whether any generated rules should be edited or removed, manually editing policies for efficiency and simplicity, and reviewing the contents of /dev/secpolgenerate/unused.
    - Reviewing for unnecessary rules
      Although secpolgenerate generates policy rules based on what was needed when the system was run, it's likely not all the rules are appropriate. QNX recommends that you review the security policy specifically to locate processes with abilities that they don't need.
    - State and event files
      The secpolgenerate utility uses files called state and event files to represent the successful or failed use of abilities and paths by processes according to their type.
    - Troubleshooting and frequently asked questions
    - The libsecpol API (secpol.h)
      The libsecpol library API provides functions for systems that use security policies.
      - Specifying the security policy file handle
        For convenience, the API functions that specify a handle to the security policy file allow you to specify NULL for handle.
      - Checking custom permissions when no policy is used
      - Customizing permissions using a security policy
        The secpol_get_permission() and secpol_check_permission() functions allow you to support fine-grained permission checking in a system that uses security policies.
      - get_ids_from_arg()
        Get identifiers from an argument string, or the string and /etc/passwd and /etc/group
      - secpol_check_permission()
        Check if a requesting process has a specified permission
      - secpol_close()
        Close the security policy file
      - secpol_flags_e
        Flags for secpol_transition_type(), secpol_posix_spawnattr_settypeid() and secpol_resolve_name()
      - secpol_get_permission()
        Returns a handle to a permission associated with a custom class
      - secpol_get_permission_flags_e
        Flags for secpol_get_permission()
      - secpol_get_policy_id()
        Return the policy ID of any policy that has been pushed to procnto
      - secpol_get_type_id()
        Return the type ID associated with a type name
      - secpol_get_type_name()
        Return the type name associated with a type ID
      - secpol_open()
        Open a security policy file
      - secpol_open_flags_e
        Flags for secpol_open()
      - secpol_posix_spawnattr_settypeid()
        Update a spawn attribute object to spawn a child with a different type
      - secpol_resmgr_attach()
        Attach a path to the pathname space with permissions set via a security policy
      - secpol_resolve_name()
        Resolve a type name to a type ID
      - secpol_transition_type()
        Transition to a new type
      - secpol_type_id()
        Return the type ID of the process
      - set_ids_from_arg()
        Change the caller's identifiers based on a given string
    - The libsecpolev API (libsecpolev.h)
      The libsecpolev library API provides functions that allow a program to monitor system trace events that relate to the successful or failed use of privileges covered by security policies.
  - Fortified System Functions
  - Pathtrust
    The pathtrust feature prevents processes from executing untrusted code. If a process is compromised, pathtrust mitigates the threat of the system being further compromised by an attacker using chained-together exploits.
  - Using mkqnximage to Display Security Features
- Utilities & Libraries
- Migrating to QNX OS 8.0
QNX Software in the Cloud
QNX Software in the Cloud enables developers to use the QNX OS in the Amazon cloud environment.
QNX Toolkit for Visual Studio Code
This User's Guide describes the QNX^® Toolkit for Visual Studio Code. The guide introduces you to the QNX Toolkit by explaining the QNX development environment and how to build, run, and debug your QNX^® Operating System (OS) applications and systems.
QNX Hypervisor User's Guide
This User's Guide explains the QNX hypervisor architecture and provides instructions for installing and running a QNX Hypervisor system, changing system components and configuration, and using hypervisor features such as virtual devices (vdevs).
Typographical Conventions, Support, and Licensing
This section describes the typographical conventions used throughout the documentation, explains how to obtain technical support, and provides some information about licensing.

secpol_check_permission()

QNX SDP8.0QNX OS System Security GuideAPIConfiguration

Check if a requesting process has a specified permission

Synopsis:

#include <secpol/secpol.h>

int secpol_check_permission(const struct _msg_info *info,
                            uint32_t otype,
                            const secpol_permission_t *permission)

Arguments:

info: The message information associated with the message that this check relates to.
otype: The type of the object being accessed or acted on.
permission: A handle to a permission returned by secpol_get_permission().

Library:

libsecpol

Description:

When a call to secpol_check_permission() fails, it indicates that the caller is denied the permission check. In most cases, all errors should be treated identically.

The otype argument allows you to restrict the test for a permission to a specific object that the permission accesses or acts on. For more information, see Customizing permissions using a security policy.

If the system is not using security policies, permission checking is performed by evaluating the class and permission name specified by secpol_get_permission() against environment variables. See Checking custom permissions when no policy is used.

Returns:

0 if the requesting process has the indicated permission for the type otype, or -1 if the call failed. On failure, errno is set to one of the following values:

EPERM Permission denied.
EINVAL Invalid parameters to function.
ENOMEM Out of memory.

Page updated: August 11, 2025