Tutorial: Build a system that uses a security policy

Updated: October 28, 2024

The steps for developing a QNX Neutrino system that uses a security policy include adding security types and generating a policy using the secpolgenerate utility.

You can also use mkqnximage to create a system image that demonstrates how security policies work. See “Secpol and policy options” in the “Using mkqnximage to Display Security Features” chapter.

Setting up a system to use security types
Before you can generate or apply a security policy, you need to specify a type for each process in your system.
Booting the system for the first time
After you add security types to your system, a security policy is required to boot it. The secpolgenerate utility provides an easy method for creating this policy.
The generated security policy
The generated security policy contains a set of rules that describes the abilities that processes used and where they attached themselves in the path space, as observed by secpolgenerate.
Compiling the security policy
You compile the security policy provided by secpolgenerate using the secpolcompile utility.
Booting securely
To boot the system securely, remove the lines that run secpolgenerate from the startup script, rebuild the OS image, and reboot.
Developing systems with a security policy
In most development environments, security policies will need to be revised or updated. For example, your initial attempt at a policy may not account for all desired behavior, or you might add a new program or new version of a program. Although you can capture any new rules that are required by running secpolgenerate again in an unrestricted manner, in most cases it's better to selectively remove restrictions using the configuration file.
The error file
The secpolgenerate utility provides the file /dev/secpolgenerate/errors to help you debug broken systems.
System monitoring using secpolgenerate
In addition to development tasks, you can use secpolgenerate in a secure, deployed system to detect errors.
Security policy maintenance
Maintenance tasks for your security policy can include determining whether any generated rules should be edited or removed, manually editing policies for efficiency and simplicity, and reviewing the contents of /dev/secpolgenerate/unused.
Reviewing for unnecessary rules
Although secpolgenerate generates policy rules based on what was needed when the system was run, it's likely not all the rules are appropriate. QNX recommends that you review the security policy specifically to locate processes with abilities that they don't need.
procmgr_ability() calls and the security policy
When you use security policies, QNX strongly recommends that you run procnto with the -bl option.
Event and state files
The secpolgenerate utility provides a mechanism that saves and loads data about abilities and paths that types used or failed to use.
Troubleshooting and frequently asked questions

Parent topic: Security Policies