link管理
链接快照平台
- 输入网页链接，自动生成快照
- 标签化管理网页链接
相关文章推荐
|
时尚的楼梯 · 在 Docker 中运行 Milvus ...· 4 天前 · |
|
|
成熟的火柴 · Using opencv in linux ...· 4 天前 · |
|
|
善良的勺子 · 【c++】linux删除文件夹（包括路径下文 ...· 4 天前 · |
|
|
胡子拉碴的眼镜 · Linux文本处理三剑客之awk学习笔记03 ...· 昨天 · |
|
|
文武双全的灭火器 · Apline binary for AWS ...· 13 小时前 · |
|
|
满身肌肉的滑板 · androidstudio ...· 6 月前 · |
|
|
贪玩的火车 · 风雨兼程不忘初心使命，砥砺奋进再续时代华章 ...· 6 月前 · |
|
|
耍酷的书签 · How to implement ...· 7 月前 · |
|
|
逃课的针织衫 · 日本2023年春季动画 - 萌娘百科 ...· 8 月前 · |
|
|
销魂的自行车 · ToggleButton· 8 月前 · |
link管理
›
8.6 Release Notes Red Hat Enterprise Linux 8 | Red Hat Customer Portal
| enterprise linux系统 |
| https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/8.6_release_notes/index |
|
潇洒的葡萄
1 年前 |
Increase visibility into IT operations to detect and resolve technical issues before they impact your business.
Learn More Go to InsightsEngage with our Red Hat Product Security team, access security updates, and ensure your environments are not exposed to any known security vulnerabilities. Product Security Center
Keep your systems secure with Red Hat's specialized responses to security vulnerabilities. View Responses
Abstract
The Release Notes provide high-level coverage of the improvements and additions that have been implemented in Red Hat Enterprise Linux 8.6 and document known problems in this release, as well as notable bug fixes, Technology Previews, deprecated functionality, and other details.
Making open source more inclusive
Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see our CTO Chris Wright’s message .
Providing feedback on Red Hat documentation
We appreciate your input on our documentation. Please let us know how we could make it better. To do so: For simple comments on specific passages, make sure you are viewing the documentation in the Multi-page HTML format. Highlight the part of text that you want to comment on. Then, click the Add Feedback pop-up that appears below the highlighted text, and follow the displayed instructions. For submitting more complex feedback, create a Bugzilla ticket: Go to the Bugzilla website. As the Component, use Documentation . Fill in the Description field with your suggestion for improvement. Include a link to the relevant part(s) of documentation. Click Submit Bug .
Chapter 1. Overview
1.1. Major changes in RHEL 8.6
Security
In RHEL 8.6, SELinux, the
fapolicyd
framework, and Policy-Based Decryption (PBD) for automated unlocking of LUKS-encrypted drives support the SAP HANA database management system. See the
Red Hat Enterprise Linux Security Hardening Guide for SAP HANA 2.0
Knowledgebase article for more information.
Packages for
fapolicyd
have been upgraded to the upstream version 1.1. Among other improvements, you can now use the new
rules.d/
and
trust.d/
directories, the
fagenrules
script, and new options for the
fapolicyd-cli
command.
OpenSSH servers now support drop-in configuration files.
The
pcsc-lite
packages have been rebased to upstream version 1.9.5, which provides many enhancements and bug fixes.
You can now verify the versions of installed SELinux policy modules with the newly added
--checksum
option to the
semodule
command.
The SCAP Security Guide (SSG) packages have been rebased to upstream version 0.1.60, and the OpenSCAP packages have been rebased to upstream version 1.3.6.
See
New features - Security
for more information.
Dynamic programming languages, web and database servers
Later versions of the following components are now available as new module streams: PHP 8.0 Perl 5.32 See New features - Dynamic programming languages, web and database servers for more information.
Compilers and development tools
Updated compiler toolsets
The following compiler toolsets have been updated: GCC Toolset 11 LLVM Toolset 13.0.1 Rust Toolset 1.58.1 Go Toolset 1.17.7 See New features - Compilers and development tools for more information.
Java implementations in RHEL 8
The RHEL 8 AppStream repository includes:
The
java-17-openjdk
packages, which provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.
The
java-11-openjdk
packages, which provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.
The
java-1.8.0-openjdk
packages, which provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.
For more information, see
OpenJDK documentation
.
Java tools
RHEL 8.6 introduces a new
log4j:2
module, which contains
Apache Log4j 2
, which is a Java logging utility and a library enabling you to output log statements to a variety of output targets.
For more information, see
New features - Compilers and development tools
. information.
Identity Management
The
ansible-freeipa
roles and modules are now available in the Ansible Automation Hub, which provides fast updates of the
ansible-freeipa
content.
1.2. In-place upgrade and OS conversion
In-place upgrade from RHEL 7 to RHEL 8
The supported in-place upgrade paths currently are:
From RHEL 7.9 to RHEL 8.4 and RHEL 8.6 on the 64-bit Intel, IBM POWER 8 (little endian), and IBM Z architectures
From RHEL 7.6 to RHEL 8.4 on architectures that require kernel version 4.14: IBM POWER 9 (little endian) and IBM Z (Structure A). This is the final in-place upgrade path for these architectures.
From RHEL 7.9 to RHEL 8.2 and RHEL 8.6 on systems with SAP HANA on the 64-bit Intel architecture. To ensure your system with SAP HANA remains supported after upgrading to RHEL 8.2, enable the RHEL 8.2 Update Services for SAP Solutions (E4S) repositories.
For more information, see
Supported in-place upgrade paths for Red Hat Enterprise Linux
. For instructions on performing an in-place upgrade, see
Upgrading from RHEL 7 to RHEL 8
. For instructions on performing an in-place upgrade on systems with SAP environments, see
How to in-place upgrade SAP environments from RHEL 7 to RHEL 8
.
Notable enhancements include:
With the release of RHEL 8.6, multiple upgrade paths are now available for the in-place upgrade from RHEL 7 to RHEL 8. This allows you to decide which RHEL 8 minor version you want to upgrade your system to instead of upgrading to the latest RHEL 8 minor version by default. Note that the available upgrade paths differ between RHEL systems and RHEL systems with SAP HANA.
The
Leapp
utility now runs significantly faster during the pre-upgrade and the initial stages of the in-place upgrade.
The in-place upgrade is also supported for SAP hosting systems for the following cloud image types:
Bring-your-own-subscription (BYOS) systems on any public cloud platform which uses Red Hat Subscription Manager (RHSM) for a RHEL subscription.
Pay-as-you-go (PAYG) instances on Amazon Web Services (AWS) and Microsoft Azure with Red Hat Update Infrastructure (RHUI).
In-place upgrade from RHEL 6 to RHEL 8
To upgrade from RHEL 6.10 to RHEL 8, follow instructions in Upgrading from RHEL 6 to RHEL 8 .
In-place upgrade from RHEL 8 to RHEL 9
Instructions on how to perform an in-place upgrade from RHEL 8 to RHEL 9 using the Leapp utility are provided by the document Upgrading from RHEL 8 to RHEL 9 . Major differences between RHEL 8 and RHEL 9 are documented in Considerations in adopting RHEL 9 .
Conversion from a different Linux distribution to RHEL
If you are using CentOS Linux 8 or Oracle Linux 8, you can convert your operating system to RHEL 8 using the Red Hat-supported
Convert2RHEL
utility. For more information, see
Converting from an RPM-based Linux distribution to RHEL
.
If you are using an earlier version of CentOS Linux or Oracle Linux, namely versions 6 or 7, you can convert your operating system to RHEL and then perform an in-place upgrade to RHEL 8. Note that CentOS Linux 6 and Oracle Linux 6 conversions use the unsupported
Convert2RHEL
utility. For more information on unsupported conversions, see
How to perform an unsupported conversion from a RHEL-derived Linux distribution to RHEL
.
For information regarding how Red Hat supports conversions from other Linux distributions to RHEL, see the
Convert2RHEL Support Policy document
.
1.3. Red Hat Customer Portal Labs
Red Hat Customer Portal Labs is a set of tools in a section of the Customer Portal available at https://access.redhat.com/labs/ . The applications in Red Hat Customer Portal Labs can help you improve performance, quickly troubleshoot issues, identify security problems, and quickly deploy and configure complex applications. Some of the most popular applications are: Registration Assistant Product Life Cycle Checker Kickstart Generator Kickstart Converter Red Hat Enterprise Linux Upgrade Helper Red Hat Satellite Upgrade Helper Red Hat Code Browser JVM Options Configuration Tool Red Hat CVE Checker Red Hat Product Certificates Load Balancer Configuration Tool Yum Repository Configuration Helper Red Hat Memory Analyzer Kernel Oops Analyzer Red Hat Product Errata Advisory Checker
1.4. Additional resources
- Capabilities and limits of Red Hat Enterprise Linux 8 as compared to other versions of the system are available in the Knowledgebase article Red Hat Enterprise Linux technology capabilities and limits . Information regarding the Red Hat Enterprise Linux life cycle is provided in the Red Hat Enterprise Linux Life Cycle document. The Package manifest document provides a package listing for RHEL 8. Major differences between RHEL 7 and RHEL 8 , including removed functionality, are documented in Considerations in adopting RHEL 8 . Instructions on how to perform an in-place upgrade from RHEL 7 to RHEL 8 are provided by the document Upgrading from RHEL 7 to RHEL 8 . The Red Hat Insights service, which enables you to proactively identify, examine, and resolve known technical issues, is now available with all RHEL subscriptions. For instructions on how to install the Red Hat Insights client and register your system to the service, see the Red Hat Insights Get Started page.
Chapter 2. Architectures
Red Hat Enterprise Linux 8.6 is distributed with the kernel version 4.18.0-372, which provides support for the following architectures: AMD and Intel 64-bit architectures The 64-bit ARM architecture IBM Power Systems, Little Endian 64-bit IBM Z Make sure you purchase the appropriate subscription for each architecture. For more information, see Get Started with Red Hat Enterprise Linux - additional architectures . For a list of available subscriptions, see Subscription Utilization on the Customer Portal.
Chapter 3. Distribution of content in RHEL 8
3.1. Installation
Red Hat Enterprise Linux 8 is installed using ISO images. Two types of ISO image are available for the AMD64, Intel 64-bit, 64-bit ARM, IBM Power Systems, and IBM Z architectures: Binary DVD ISO: A full installation image that contains the BaseOS and AppStream repositories and allows you to complete the installation without additional repositories. The Binary DVD ISO image is larger than 4.7 GB, and as a result, it might not fit on a single-layer DVD. A dual-layer DVD or USB key is recommended when using the Binary DVD ISO image to create bootable installation media. You can also use the Image Builder tool to create customized RHEL images. For more information about Image Builder, see the Composing a customized RHEL system image document. Boot ISO: A minimal boot ISO image that is used to boot into the installation program. This option requires access to the BaseOS and AppStream repositories to install software packages. The repositories are part of the Binary DVD ISO image. See the Performing a standard RHEL 8 installation document for instructions on downloading ISO images, creating installation media, and completing a RHEL installation. For automated Kickstart installations and other advanced topics, see the Performing an advanced RHEL 8 installation document.
3.2. Repositories
Red Hat Enterprise Linux 8 is distributed through two main repositories: BaseOS AppStream Both repositories are required for a basic RHEL installation, and are available with all RHEL subscriptions. Content in the BaseOS repository is intended to provide the core set of the underlying OS functionality that provides the foundation for all installations. This content is available in the RPM format and is subject to support terms similar to those in previous releases of RHEL. For a list of packages distributed through BaseOS, see the Package manifest . Content in the Application Stream repository includes additional user space applications, runtime languages, and databases in support of the varied workloads and use cases. Application Streams are available in the familiar RPM format, as an extension to the RPM format called modules , or as Software Collections. For a list of packages available in AppStream, see the Package manifest . In addition, the CodeReady Linux Builder repository is available with all RHEL subscriptions. It provides additional packages for use by developers. Packages included in the CodeReady Linux Builder repository are unsupported. For more information about RHEL 8 repositories, see the Package manifest .
3.3. Application Streams
Red Hat Enterprise Linux 8 introduces the concept of Application Streams. Multiple versions of user space components are now delivered and updated more frequently than the core operating system packages. This provides greater flexibility to customize Red Hat Enterprise Linux without impacting the underlying stability of the platform or specific deployments.
Components made available as Application Streams can be packaged as modules or RPM packages and are delivered through the AppStream repository in RHEL 8. Each Application Stream component has a given life cycle, either the same as RHEL 8 or shorter. For details, see
Red Hat Enterprise Linux Life Cycle
.
Modules are collections of packages representing a logical unit: an application, a language stack, a database, or a set of tools. These packages are built, tested, and released together.
Module streams represent versions of the Application Stream components. For example, several streams (versions) of the PostgreSQL database server are available in the
postgresql
module with the default
postgresql:10
stream. Only one module stream can be installed on the system. Different versions can be used in separate containers.
Detailed module commands are described in the
Installing, managing, and removing user-space components
document. For a list of modules available in AppStream, see the
Package manifest
.
3.4. Package management with YUM/DNF
On Red Hat Enterprise Linux 8, installing software is ensured by the
YUM
tool, which is based on the
DNF
technology. We deliberately adhere to usage of the
yum
term for consistency with previous major versions of RHEL. However, if you type
dnf
instead of
yum
, the command works as expected because
yum
is an alias to
dnf
for compatibility.
For more details, see the following documentation:
Installing, managing, and removing user-space components
Considerations in adopting RHEL 8
Chapter 4. New features
This part describes new features and major enhancements introduced in Red Hat Enterprise Linux 8.6.
4.1. Installer and image creation
Image Builder supports customized file system partition on LVM
With this enhancement, if you have more than one partition, you can create images with a customized file system partition on LVM and resize those partitions at runtime. For that, you can specify a customized filesystem configuration in your blueprint and then create images with the desired disk layout. The default filesystem layout remains unchanged - if you use plain images without file system customization, the root partition is resized by
cloud-init
.
(JIRA:RHELPLAN-102505)
4.2. RHEL for Edge
RHEL for Edge now supports
Greenboot
built-in health checks by default
With this update, RHEL for Edge
Greenboot
now includes built-in health checks with
watchdog
feature to ensure that the hardware does not hang or freeze while rebooting. With that, you can benefit from the following features:
It makes it simple for
watchdogs
hardware users to adopt the built-in health checks
A set of default health checks that provide value for built-in OS components
The
watchdog
is now present as default presets, which makes it easy to enable or disable this feature
Ability to create custom health checks based on the already available health checks.
(
BZ#2083036
)
RHEL 8 rebased to
rpm-ostree
v2022.2
RHEL 8 is distributed with the
rpm-ostree
version v2022.2, which provides multiple bug fixes and enhancements. Notable changes include:
Kernel arguments can now be updated in an idempotent way, by using the new
--append-if-missing
and
--delete-if-present
kargs flags.
The
Count Me
feature from YUM is now fully disabled by default in all repo queries and will only be triggered by the corresponding
rpm-ostree-countme.timer
and
rpm-ostree-countme.service
units. See
countme
.
The post-processing logic can now process the
user.ima
IMA extended attribute. When an
xattr
extended attribute is found, the system automatically translates it to
security.ima
in the final
OSTree
package content.
The
treefile
file has a new
repo-packages
field. You can use it to pin a set of packages to a specific repository.
Ability to use modularity on the compose and client side.
Container images are now used as a compose target and also as an upgrade source.
(
BZ#2032594
)
4.3. Subscription management
Merged system purpose commands under
subscription-manager syspurpose
Previously, there were multiple subscription-manager modules (
addons
,
role
,
service-level
, and
usage
) for setting attributes related to system purpose. These modules have been moved under the new
subscription-manager syspurpose
module.
The original subscription-manager modules (
addons
,
role
,
service-level
, and
usage
) are now deprecated. Additionally, the package (
python3-syspurpose
) that provides the
syspurpose
command line tool has been deprecated in RHEL 8.6. All the capabilities of this package are covered by the new
subscription-manager syspurpose
module.
This update provides a consistent way to view, set, and update all system purpose attributes using a single command of subscription-manager; this replaces all the existing system purpose commands with their equivalent versions available as a new subcommand. For example,
subscription-manager role --set SystemRole
becomes
subscription-manager syspurpose role --set SystemRole
and so on.
For complete information about the new commands, options, and other attributes, see the
SYSPURPOSE OPTIONS
section in the
subscription-manager
man page.
(
BZ#2000883
)
4.4. Software management
The
modulesync
command is now available to replace certain workflows in RHEL 8
In Red Hat Enterprise Linux 8, modular packages cannot be installed without modular metadata. Previously, you could use the
yum
command to download packages, and then use the
createrepo_c
command to redistribute those packages.
This enhancement introduces the
modulesync
command to ensure the presence of modular metadata, which ensures package installability. This command downloads
rpm
packages from modules and creates a repository with modular metadata in a working directory.
(
BZ#1868047
)
A new
--path
CLI option is added to RPM
With this update, you can query packages by a file that is currently not installed using a new
--path
CLI option. This option is similar to the existing
--file
option, but matches packages solely based on the provided path. Note that the file at that path does not need to exist on disk.
The
--path
CLI option can be useful when a user excludes all documentation files at install time by using the
--nodocs
option with
yum
. In this case, by using the
--path
option, you can display the owning package of such an excluded file, whereas the
--file
option will not display the package because the requested file does not exist.
(
BZ#1940895
)
4.5. Shells and command-line tools
The
lsvpd
package rebased to version 1.7.13
The
lsvpd
package has been rebased to version 1.7.13. Notable bug fixes and enhancements include:
Added support for SCSI location code.
Fixed length of absolute path
getDevTreePath
in
sysfstreecollector
.
(BZ#1993557)
The
net-snmp-cert gencert
tool now uses the SHA512 encryption algorithm instead of SHA1
In order to increase security, the
net-snmp-cert gencert
tool has been updated to generate certificates using SHA512 encryption algorithm by default.
(
BZ#1908331
)
The
dnn
and
text
modules are available in the
opencv
package
The
dnn
module containing Deep Neural Networks for image classification inference and the
text
module for scene text detection and recognition are now available in the
opencv
package.
(
BZ#2007780
)
The
powerpc-utils
package rebased to version 1.3.9
The
powerpc-utils
package has been upgraded to version 1.3.9. Notable bug fixes, and enhancements include:
Increased log size to 1MB in
drmgr
.
Fixed checking
HCNID
array size at boot time.
Implemented
autoconnect-slaves
on HNV connections in
hcnmgr
.
Improved the HNV bond list connections in
hcnmgr
.
Uses
hexdump
from
util-linux
instead of
xxd
from
vim
in
hcnmgr
.
The
hcn-init.service
starts together with NetworkManager.
Fixed OF to logical FC lookup for multipath in
ofpathname
.
Fixed OF to logical lookup with partitions in
ofpathname
.
Fixed bootlist for multipath devices with more than 5 paths.
Introduced
lparnumascore
command to detect the NUMA affinity score for the running LPAR.
Added the
-x
option in
lpartstat
to enhance security.
Fixed
ofpathname
race with
udev
rename in
hcnmgr
.
Fixed
qrydev
in HNV, and removed
lsdevinfo
.
(BZ#2028690)
The
powerpc-utils
package now supports vNIC as a backup device
The
powerpc-utils
package now supports Virtual Network Interface cards (vNIC) as a backup
vdevice
for Hybrid Network Virtualization (HNV).
(BZ#2022225)
The
opencryptoki
package rebased to version 3.17.0
The
opencryptoki
package has been rebased to version 3.17.0. Notable bug fixes and enhancements include:
The
p11sak
tool offers a new function of listing keys.
Added support for
OpenSSL 3.0
.
Added support for event notifications.
Added SW fallbacks in ICA tokens.
The WebSphere Application Server no longer fails to start with the hardware crypto adapter enabled.
The
opencryptoki.module
was removed, and the
p11-kit list-modules
command no longer causes error messages.
(BZ#1984993)
Certain network interfaces and IP addresses can be excluded when creating a rescue image
You can use the
EXCLUDE_IP_ADDRESSES
variable to ignore certain IP addresses, and the
EXCLUDE_NETWORK_INTERFACES
variable to ignore certain network interfaces when creating a rescue image.
On servers with floating addresses, you need to stop the ReaR rescue environment from configuring floating addresses that are moved to a fail-over server until the original server is recovered. Otherwise, a conflict with the fail-over server would occur and cause a consequent disruption of the services running on the fail-over server. To prevent conflicts, you can perform the following actions in the ReaR configuration file
/etc/rear/local.conf
:
exclude the IP addresses in the ReaR by providing the
EXCLUDE_IP_ADDRESSES
variable as a bash array of addresses. For example:
EXCLUDE_IP_ADDRESSES=( 192.0.2.27 192.0.2.10 )
,
exclude the network interfaces in the ReaR by providing the
EXCLUDE_NETWORK_INTERFACES
variable as a bash array of interfaces. For example:
EXCLUDE_NETWORK_INTERFACES=( eno1d1 )
.
(
BZ#2035939
)
4.6. Infrastructure services
New
bind9.16
package version 9.16.23 introduced
A new
bind9.16
package version 9.16.23 has been introduced as an alternative to
bind
component version 9.11.36. Notable enhancements include:
Introduced new Key and Signing Policy feature in DNSSEC.
Introduced the QNAME minimisation to improve privacy.
Introduced the
validate-except
feature to Permanent.
Negative Trust Anchors to temporarily disable DNSSEC validation.
Refactored the response policy zones (RPZ).
Introduced new naming conventions for zone types:
primary
and
secondary
zone types are used as synonyms to
master
and
slave
.
Introduced a supplementary YAML output mode of
dig
,
mdig
, and
delv
commands.
The
filter-aaaa
functionality was moved into separate
filter-a
and
filter-aaaa
plugins.
Introduced a new zone type mirror support (
RFC 8806
).
Removed features:
The
dnssec-enabled
option has been removed, DNSSEC is enabled by default, and the
dnssec-enabled
keywords are no longer accepted.
The
lwresd
lightweight resolver daemon, and
liblwres
lightweight resolver library have been removed.
(BZ#1873486)
CUPS is available as a container image
The Common Unix Printing System (CUPS) is now available as a container image, and you can deploy it from the Red Hat Container Catalog. (BZ#1913715)
The
bind
component rebased to version 9.11.36
The
bind
component has been updated to version 9.11.36. Notable bug fixes and enhancements include:
Improved the
lame-ttl
option to be more secure.
A multiple threads bug affecting RBTDB instances no longer results in assertion failure in
free_rbtdb()
.
Updated implementation of the ZONEMD RR type to match RFC 8976.
The maximum supported number of NSEC3 iterations has been reduced to 150. Records with more iterations are treated as insecure.
An invalid direction field in a LOC record no longer results in a failure.
(
BZ#2013993
)
CUPS driverless printing is available in CUPS Web UI
CUPS driverless printing, based on the IPP Everywhere model, is available in the CUPS Web UI. In addition to the
lpadmin
command used in the CLI, you can create an IPP Everywhere queue in the CUPS Web UI to print to network printers without special software.
For more information, see
Configuring driverless printing
(
BZ#2032965
)
4.7. Security
The
pcsc-lite
packages rebased to 1.9.5
The
pcsc-lite
packages have been rebased to upstream version 1.9.5. This update provides new enhancements and bug fixes, most notably:
The
pcscd
daemon no longer automatically exits after inactivity when started manually.
The
pcsc-spy
utility now supports Python 3 and a new
--thread
option.
Performance of the
SCardEndTransaction()
function has been improved.
The
poll()
function replaced the
select()
function, which allows file descriptor numbers higher than
FD_SETSIZE
.
Many memory leaks and concurrency problems have been fixed.
(
BZ#2014641
)
Crypto policies support
diffie-hellman-group14-sha256
You can now use the
diffie-hellman-group14-sha256
key exchange (KEX) algorithm for the
libssh
library in RHEL system-wide cryptographic policies. This update also provides parity with OpenSSH, which also supports this KEX algorithm. With this update,
libssh
has
diffie-hellman-group14-sha256
enabled by default, but you can disable it by using a custom crypto policy.
(
BZ#2023744
)
OpenSSH servers now support drop-in configuration files
The
sshd_config
file supports the
Include
directive, which means you can include configuration files in another directory. This makes it easier to apply system-specific configurations on OpenSSH servers by using automation tools such as Ansible Engine. It is also more consistent with the capabilities of the
ssh_config
file. In addition, drop-in configuration files also make it easier to organize different configuration files for different uses, such as filter incoming connections.
(BZ#1926103)
sshd_config:ClientAliveCountMax=0
disables connection termination
Setting the SSHD configuration option
ClientAliveCountMax
to
0
now disables connection termination. This aligns the behavior of this option with the upstream. As a consequence, OpenSSH no longer disconnects idle SSH users when it reaches the timeout configured by the
ClientAliveInterval
option.
(
BZ#2015828
)
libssh
rebased to 0.9.6
The
libssh
package has been rebased to upstream version 0.9.6. This version provides bug fixes and enhancements, most notably:
Support for multiple identity files. The files are processed from the bottom to the top as listed in the
~/.ssh/config
file.
Parsing of sub-second times in SFTP is fixed.
A regression of the
ssh_channel_poll_timeout()
function returning
SSH_AGAIN
unexpectedly is now fixed.
A possible heap-buffer overflow after key re-exchange is fixed.
A handshake bug when AEAD cipher is matched but there is no HMAC overlap is fixed.
Several memory leaks on error paths are fixed.
(
BZ#1896651
)
Libreswan rebased to 4.5
Libreswan has been rebased to upstream version 4.5. This version provides many bug fixes and enhancements, most notably: Support of Internet Key Exchange version 2 (IKEv2) for Labeled IPsec. Support for childless initiation of Internet Key Exchange (IKE) Security Association (SA). (BZ#2017352)
New option to verify SELinux module checksums
With the newly added
--checksum
option to the
semodule
command, you can verify the versions of installed SELinux policy modules.
Because Common Intermediate Language (CIL) does not store module name and module version in the module itself, there previously was no simple way to verify that the installed module is the same version as the module which was supposed to be installed.
With the new command
semodule -l --checksum
, you receive a SHA256 hash of the specified module and can compare it with the checksum of the original file, which is faster than reinstalling modules.
Example of use:
# semodule -l --checksum | grep localmodule localmodule sha256:db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd # /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd -
( BZ#1731501 )
OpenSCAP can read local files
OpenSCAP can now consume local files instead of remote SCAP source data stream components. Previously, you could not perform a complete evaluation of SCAP source data streams containing remote components on systems that have no internet access. On these systems, OpenSCAP could not evaluate some of the rules in these data streams because the remote components needed to be downloaded from the internet. With this update, you can download and copy the remote SCAP source data stream components to the target system before performing the OpenSCAP scan and provide them to OpenSCAP by using the
--local-files
option with the
oscap
command.
(
BZ#1970529
)
SSG now scans and remediates rules for home directories and interactive users
OVAL content to check and remediate all existing rules related to home directories used by interactive users was added to the SCAP Security Guide (SSG) suite. Many benchmarks require verification of properties and content usually found within home directories of interactive users. Because the existence and the number of interactive users in a system may vary, there was previously no robust solution to cover this gap using the OVAL language. This update adds OVAL checks and remediations that detect local interactive users in a system and their respective home directories. As a result, SSG can safely check and remediate all related benchmark requirements. ( BZ#1884687 )
SCAP rules now have a warning message to configure Audit log buffer for large systems
The SCAP rule
xccdf_org.ssgproject.content_rule_audit_basic_configuration
now displays a performance warning that suggests users of large systems where the Audit log buffer configured by this rule might be too small and can override the custom value. The warning also describes the process to configure a larger Audit log buffer. With this enhancement, users of large systems can stay compliant and have their Audit log buffer set correctly.
(
BZ#1993826
)
SSG now supports the
/etc/security/faillock.conf
file
This enhancement adds support for the
/etc/security/faillock.conf
file in SCAP Security Guide (SSG). With this update, SSG can assess and remediate the
/etc/security/faillock.conf
file for definition of
pam_faillock
settings. The
authselect
tool is also used to enable the
pam_faillock
module while ensuring the integrity of
pam
files. As a result, the assessment and remediation of the
pam_faillock
module is aligned with the latest versions and best practices.
(
BZ#1956972
)
SCAP Security Guide rebased to 0.1.60
The SCAP Security Guide (SSG) packages have been rebased to upstream version 0.1.60. This version provides various enhancements and bug fixes, most notably:
Rules hardening the PAM stack now use
authselect
as the configuration tool.
Tailoring files that define profiles which represent the differences between DISA STIG automated SCAP content and SCAP automated content (delta tailoring) are now supported.
The rule
xccdf_org.ssgproject.content_enable_fips_mode
now checks only whether the FIPS mode has been enabled properly. It does not guarantee that system components have undergone FIPS certification.
(
BZ#2014485
)
DISA STIG profile supports Red Hat Virtualization 4.4
The
DISA STIG for Red Hat Enterprise Linux 8
profile version V1R5 has been enhanced to support Red Hat Virtualization 4.4. This profile aligns with the RHEL 8 Security Technical Implementation Guide (STIG) manual benchmark provided by the Defense Information Systems Agency (DISA). However, some configurations are not applied on hosts where Red Hat Virtualization (RHV) is installed because they prevent Red Hat Virtualization from installing and working properly.
When the STIG profile is applied on a Red Hat Virtualization Host (RHVH), on a self-hosted install (RHELH), or on a host with RHV Manager installed, the following rules result in 'notapplicable':
package_gss_proxy_removed
package_krb5-workstation_removed
package_tuned_removed
sshd_disable_root_login
sudo_remove_nopasswd
sysctl_net_ipv4_ip_forward
xwindows_remove_packages
Warning
Automatic remediation might render the system non-functional. Run the remediation in a test environment first. ( BZ#2021802 )
OpenSCAP rebased to 1.3.6
The OpenSCAP packages have been rebased to upstream version 1.3.6. This version provides various bug fixes and enhancements, most notably:
You can provide local copies of remote SCAP source data stream components by using the
--local-files
option.
OpenSCAP accepts multiple
--rule
arguments to select multiple rules on the command line.
OpenSCAP allows skipping evaluation of some rules using the
--skip-rule
option.
You can restrict memory consumed by OpenSCAP probes by using the
OSCAP_PROBE_MEMORY_USAGE_RATIO
environment variable.
OpenSCAP now supports the OSBuild Blueprint as a remediation type.
(
BZ#2041781
)
clevis-systemd
no longer depends on
nc
With this enhancement, the
clevis-systemd
package no longer depends on the
nc
package. The dependency did not work correctly when used with Extra Packages for Enterprise Linux (EPEL).
(
BZ#1949289
)
audit
rebased to 3.0.7
The
audit
packages have been upgraded to version 3.0.7 which introduces many enhancements and bug fixes. Most notably:
Added
sudoers
to Audit base rules.
Added the
--eoe-timeout
option to the
ausearch
command and its analogous
eoe_timeout
option to
auditd.conf
file that specifies the value for end of event timeout, which impacts how
ausearch
parses co-located events.
Introduced a fix for the 'audisp-remote' plugin that used 100% of CPU capacity when the remote location was not available.
(
BZ#1939406
)
Audit now provides options for specifying the end of the event timeout
With this release, the
ausearch
tool supports the
--eoe-timeout
option, and the
auditd.conf
file contains the
end_of_event_timeout
option. You can use these options to specify the end of the event timeout to avoid problems with parsing co-located events. The default value for the end of the event timeout is set to two seconds.
(
BZ#1921658
)
Adding
sudoers
to Audit base rules
With this enhancement, the
/etc/sudoers
and the
etc/sudoers.d/
directories are added to Audit base rules such as the Payment Card Industry Data Security Standard (PCI DSS) and the Operating Systems Protection Profile (OSPP). This increases the security by monitoring configuration changes in privileged areas such as
sudoers
.
(BZ#1927884)
Rsyslog includes the
mmfields
module for higher-performance operations and CEF
Rsyslog now includes the
rsyslog-mmfields
subpackage which provides the
mmfields
module. This is an alternative to using the property replacer field extraction, but in contrast to the property replacer, all fields are extracted at once and stored inside the structured data part. As a result, you can use
mmfields
particularly for processing field-based log formats, for example Common Event Format (CEF), and if you need a large number of fields or reuse specific fields. In these cases,
mmfields
has better performance than existing Rsyslog features.
(
BZ#1947907
)
libcap
rebased to version 2.48
The
libcap
packages have been upgraded to upstream version 2.48, which provides a number of bug fixes and enhancements over the previous version, most notably:
Helper library for POSIX semantic system calls (
libpsx
)
Support for overriding system call functions
IAB abstraction for capability sets
Additional
capsh
testing features
(
BZ#2032813
)
fapolicyd
rebased to 1.1
The
fapolicyd
packages have been upgraded to the upstream version 1.1, which contains many improvements and bug fixes. Most notable changes include the following:
The
/etc/fapolicyd/rules.d/
directory for files containing allow and deny execution rules replaces the
/etc/fapolicyd/fapolicyd.rules
file. The
fagenrules
script now merges all component rule files in this directory to the
/etc/fapolicyd/compiled.rules
file. See the new
fagenrules(8)
man page for more details.
In addition to the
/etc/fapolicyd/fapolicyd.trust
file for marking files outside of the RPM database as trusted, you can now use the new
/etc/fapolicyd/trust.d
directory, which supports separating a list of trusted files into more files. You can also add an entry for a file by using the
fapolicyd-cli -f
subcommand with the
--trust-file
directive to these files. See the
fapolicyd-cli(1)
and
fapolicyd.trust(13)
man pages for more information.
The
fapolicyd
trust database now supports white spaces in file names.
fapolicyd
now stores the correct path to an executable file when it adds the file to the trust database.
(
BZ#1939379
)
libseccomp
rebased to 2.5.2
The
libseccomp
packages have been rebased to upstream version 2.5.2. This version provides bug fixes and enhancements, most notably:
Updated the syscall table for Linux to version
v5.14-rc7
.
Added the
get_notify_fd()
function to the Python bindings to get the notification file descriptor.
Consolidated multiplexed syscall handling for all architectures into one location.
Added multiplexed syscall support to the PowerPC (PPC) and MIPS architectures.
Changed the meaning of the
SECCOMP_IOCTL_NOTIF_ID_VALID
operation within the kernel.
Changed the
libseccomp
file descriptor notification logic to support the kernel’s previous and new usage of
SECCOMP_IOCTL_NOTIF_ID_VALID
.
(
BZ#2019893
)
4.8. Networking
CleanUpModulesOnExit
firewalld
global configuration option is now available
Previously, when restarting or otherwise shutting down
firewalld
,
firewalld
recursively unloaded kernel modules. As a result, other packages attempting to use these modules or dependent modules would fail. With this upgrade, users can set the
CleanUpModulesOnExit
option to
no
to stop
firewalld
from unloading these kernel modules.
(BZ#1980206)
Restoring large
nftables
sets requires less memory
With this enhancement, the
nftables
framework requires significantly less memory when you restore large sets. The algorithm which prepares the
netlink
message has been improved, and, as a result, restoring a set can use up to 40% less memory.
(
BZ#2047821
)
The
nmstate
API now supports OVS-DPDK
This enhancement adds the schema for the Open vSwitch (OVS) Data Plane Development Kit (DPDK) to the
nmstate
API. As a result, you can use
nmstate
to configure OVS devices with DPDK ports.
(
BZ#2003976
)
The
nmstate
API now supports VLAN and QoS ID in SR-IOV virtual functions
This update enhances the
nmstate
API with support for local area network (VLAN) and quality of service (QoS) in single root I/O virtualization (SR-IOV) virtual functions. As a result, you can use
nmstate
to configure these features.
(
BZ#2004006
)
NetworkManager rebased to version 1.36.0
The
NetworkManager
packages have been upgraded to upstream version 1.36.0, which provides a number of enhancements and bug fixes over the previous version:
The handling of layer 3 configurations has been reworked to improve the stability, performance, and memory usage.
NetworkManager now supports the
rd.znet_ifnames
kernel command line option on the IBM Z platform.
The
blackhole
,
unreachable
, and
prohibit
route types have been added.
NetworkManager now ignores routes managed by routing services.
The Wi-Fi Protected Access version 3 (WPA3) network security has been improved by enabling the hash-to-element (H2E) method when generating simultaneous authentication of equals (SAE) password elements.
The service now correctly handles replies from DHCP servers that send duplicate address or mask options.
You can now turn off MAC aging on bridges.
NetworkManager no longer listens for
netlink
events for traffic control objects, such as
qdiscs
and
filters
.
Network bonds now support setting a queue ID for bond ports.
For further information about notable changes, read the upstream release notes:
NetworkManager 1.36.0
NetworkManager 1.34.0
(
BZ#1996617
)
The
hostapd
package has been added to RHEL 8.6
With this release, RHEL provides the
hostapd
package. However, Red Hat supports
hostapd
only to set up a RHEL host as an 802.1X authenticator in Ethernet networks. Other scenarios, such as Wi-Fi access points or authenticators in Wi-Fi networks, are not supported.
For details about configuring RHEL as an 802.1X authenticator with a FreeRADIUS back end, see
Setting up an 802.1x network authentication service for LAN clients using hostapd with FreeRADIUS backend
.
(BZ#2016946)
NetworkManager now supports setting the number of receiving queues (
rx_queue
) on OVS-DPDK interfaces
With this enhancement, you can use NetworkManager to configure the
n_rxq
setting of Open vSwitch (OVS) Data Plane Development Kit (DPDK) interfaces. Use the
ovs-dpdk.n-rxq
attribute in NetworkManager to set the number of receiving queues on OVS-DPDK interfaces.
For example, to configure 2 receiving queues in OVS interface named
ovs-iface0
, enter:
# nmcli connection modify ovs-iface0 ovs-dpdk.nrxq 2
( BZ#2001563 )
The
nftables
framework now supports
nft
set elements with attached counters
Previously, in the
netfilter
framework,
nftables
set counters were not supported. The
nftables
framework is configurable by the
nft
tool. The kernel allows this tool to count the network packets from a given source address with a statement
add @myset {ip saddr counter}
. In this update, you can count packets that match a specific criteria with a dynamic set and elements with attached counters.
(BZ#1983635)
4.9. Kernel
Kernel version in RHEL 8.6
Red Hat Enterprise Linux 8.6 is distributed with the kernel version 4.18.0-372. See also Important changes to external kernel parameters and Device Drivers . ( BZ#1839151 )
Extended Berkeley Packet Filter for RHEL 8.6
The
Extended Berkeley Packet Filter (eBPF)
is an in-kernel virtual machine that allows code execution in the kernel space, in the restricted sandbox environment with access to a limited set of functions. The virtual machine executes a special assembly-like code.
The
eBPF
bytecode first loads to the kernel, followed by its verification, code translation to the native machine code with just-in-time compilation, and then the virtual machine executes the code.
Red Hat ships numerous components that utilize the
eBPF
virtual machine. Each component is in a different development phase, and thus not all components are currently fully supported. In RHEL 8.6, the following
eBPF
components are supported:
The
BPF Compiler Collection (BCC)
tools package, which provides tools for I/O analysis, networking, and monitoring of Linux operating systems using
eBPF
.
The
BCC
library which allows the development of tools similar to those provided in the
BCC
tools package.
The
eBPF for Traffic Control (tc)
feature, which enables programmable packet processing inside the kernel network data path.
The
bpftrace
tracing language
The
eXpress Data Path (XDP)
feature, which provides access to received packets before the kernel networking stack processes them, is supported under specific conditions. For more information see,
XDP is conditionally supported
and
Overview of networking eBPF features in RHEL
.
The
libbpf
package, which is crucial for bpf related applications like
bpftrace
and
bpf/xdp
development.
The
xdp-tools
package, which contains userspace support utilities for the
XDP
feature, is now supported on the AMD and Intel 64-bit architectures. This includes the
libxdp
library, the
xdp-loader
utility for loading XDP programs, the
xdp-filter
example program for packet filtering, and the
xdpdump
utility for capturing packets from a network interface with XDP enabled.
Note that all other
eBPF
components are available as Technology Preview, unless a specific component is indicated as supported.
The following notable
eBPF
components are currently available as Technology Preview:
The
AF_XDP
socket for connecting the
eXpress Data Path (XDP)
path to user space
For more information regarding the Technology Preview components, see
eBPF
available as a Technology Preview
.
(
BZ#1780124
)
Red Hat, by default, enables eBPF in all RHEL versions for privileged users only
Extended Berkeley Packet Filter (
eBPF
) is a complex technology which allows users to execute custom code inside the Linux kernel. Due to its nature, the
eBPF
code needs to pass through the verifier and other security mechanisms. There were Common Vulnerabilities and Exposures (CVE) instances, where bugs in this code could be misused for unauthorized operations. To mitigate this risk, Red Hat by default enabled
eBPF
in all RHEL versions for privileged users only. It is possible to enable
eBPF
for unprivileged users by using the kernel.command-line parameter
unprivileged_bpf_disabled=0
.
However, note that:
Applying
unprivileged_bpf_disabled=0
disqualifies your kernel from Red Hat support and opens your system to security risks.
Red Hat urges you to treat processes with the
CAP_BPF
capability as if the capability was equal to
CAP_SYS_ADMIN
.
Setting
unprivileged_bpf_disabled=0
will not be sufficient to execute many BPF programs by unprivileged users as loading of most BPF program types requires additional capabilities (typically
CAP_SYS_ADMIN
or
CAP_PERFMON
).
For information on how to apply kernel command-line parameters, see
Configuring kernel command-line parameters
.
(BZ#2089409)
The
osnoise
and
timerlat
tracers were added in RHEL 8
The
osnoise
tracer measures operating system noise. That is, the interruptions of applications by the OS and hardware interrupts. It also provides a set of tracepoints to help find the source of the OS noise. The
timerlat
tracer measures the wakeup latencies and helps to identify the causes of such latencies of real-time (RT) threads. In RT computing, latency is absolutely crucial and even a minimal delay can be detrimental. The
osnoise
and
timerlat
tracers enable you to investigate and find causes of OS interference with applications and wakeup delay of RT threads.
(BZ#1979382)
The
strace
utility can now display mismatches between the actual SELinux contexts and the definitions extracted from the SELinux context database
An existing
--secontext
option of
strace
has been extended with the
mismatch
parameter. This parameter enables to print the expected context along with the actual one upon mismatch only. The output is separated by double exclamation marks (
!!
), first the actual context, then the expected one. In the examples below, the
full,mismatch
parameters print the expected full context along with the actual one because the user part of the contexts mismatches. However, when using a solitary
mismatch
, it only checks the type part of the context. The expected context is not printed because the type part of the contexts matches.
[...] $ strace --secontext=full,mismatch -e statx stat /home/user/file statx(AT_FDCWD, "/home/user/file" [system_u:object_r:user_home_t:s0!!unconfined_u:object_r:user_home_t:s0], ... $ strace --secontext=mismatch -e statx stat /home/user/file statx(AT_FDCWD, "/home/user/file" [user_home_t:s0], ...
SELinux context mismatches often cause access control issues associated with SELinux. The mismatches printed in the system call traces can significantly expedite the checks of SELinux context correctness. The system call traces can also explain specific kernel behavior with respect to access control checks. ( BZ#2038992 , BZ#2038810 )
The
--cyclictest-threshold
option has been added to the
rteval
utility
With this enhancement, the
--cyclictest-threshold=USEC
option has been added to the
rteval
test suite. Using this option you can specify a threshold value. The
rteval
test run ends immediately if any latency measurements exceed this threshold value. When latency expectations are not met, the run aborts with a failure status.
(
BZ#2012285
)
4.10. File systems and storage
RHEL 8.6 is compatible with RHEL 9 XFS images
With this update, RHEL 8.6 is now able to use RHEL 9 XFS images. RHEL 9 XFS guest images must have
bigtime
and inode btree counters (
inobtcount
) on-disk capabilities allowed in order to mount the guest image with RHEL 8.6. Note that file systems created with
bigtime
and
inobtcount
features are not compatible with versions earlier than RHEL 8.6.
(BZ#2022903,
BZ#2024201
)
Options in Samba utilities have been renamed and removed for a consistent user experience
The Samba utilities have been improved to provide a consistent command-line interface. These improvements include renamed and removed options. Therefore, to avoid problems after the update, review your scripts that use Samba utilities, and update them, if necessary.
Samba 4.15 introduces the following changes to the Samba utilities:
Previously, Samba command-line utilities silently ignored unknown options. To prevent unexpected behavior, the utilities now consistently reject unknown options.
Several command-line options now have a corresponding
smb.conf
variable to control their default value. See the man pages of the utilities to identify if a command-line option has an
smb.conf
variable name.
By default, Samba utilities now log to standard error (
stderr
). Use the
--debug-stdout
option to change this behavior.
The
--client-protection=off|sign|encrypt
option has been added to the common parser.
The following options have been renamed in all utilities:
--kerberos
to
--use-kerberos=required|desired|off
--krb5-ccache
to
--use-krb5-ccache=
CCACHE
--scope
to
--netbios-scope=
SCOPE
--use-ccache
to
--use-winbind-ccache
The following options have been removed from all utilities:
-e
and
--encrypt
-C
removed from
--use-winbind-ccache
-i
removed from
--netbios-scope
-S
and
--signing
To avoid duplicate options, certain options have been removed or renamed from the following utilities:
ndrdump
:
-l
is no longer available for
--load-dso
net
:
-l
is no longer available for
--long
sharesec
:
-V
is no longer available for
--viewsddl
smbcquotas
:
--user
has been renamed to
--quota-user
nmbd
:
--log-stdout
has been renamed to
--debug-stdout
smbd
:
--log-stdout
has been renamed to
--debug-stdout
winbindd
:
--log-stdout
has been renamed to
--debug-stdout
(
BZ#2062117
)
Compiler barrier changed to static inline function
compiler_barrier
to avoid name conflict with function pointers
This enhancement provides additional features and a patch for a potential data corruption bug. The compiler barrier is now set to a static inline function
compiler_barrier
. No name conflict occurs with the hardware store barrier, when implementing hardware fencing for non-temporal memcpy variants, while using a function pointer. As a result, RHEL 8.6 now includes
pmdk
version 1.11.1.
(BZ#2009889)
4.11. High availability and clusters
The
pcmk_delay_base
parameter may now take different values for different nodes
When configuring a fence device, you now can specify different values for different nodes with the
pcmk_delay_base parameter
. This allows a single fence device to be used in a two-node cluster, with a different delay for each node. This helps prevent a situation where each node attempts to fence the other node at the same time. To specify different values for different nodes, you map the host names to the delay value for that node using a similar syntax to pcmk_host_map. For example, node1:0;node2:10s would use no delay when fencing node1 and a 10-second delay when fencing node2.
(
BZ#1082146
)
Specifying automatic removal of location constraint following resource move
When you execute the
pcs resource move
command, this adds a constraint to the resource to prevent it from running on the node on which it is currently running. A new
--autodelete
option for the
pcs resource move
command, previously available as a Technology Preview, is now fully supported. When you specify this option, the location constraint that the command creates is automatically removed once the resource has been moved.
(BZ#1990784)
Detailed Pacemaker status display for internal errors
If Pacemaker can not execute a resource or fence agent for some reason, for example the agent is not installed or there has been an internal timeout, the Pacemaker status displays now show a detailed exit reason for the internal error. (BZ#1470834)
Support for special characters inside
pcmk_host_map
values
The
pcmk_host_map
property now supports special characters inside
pcmk_host_map
values using a backslash (\) in front of the value. For example, you can specify
pcmk_host_map="node3:plug\ 1"
to include a space in the host alias.
(
BZ#1376538
)
pcs
suppport for OCF Resource Agent API 1.1 standard
The
pcs
command-line interface now supports OCF 1.1 resource and STONITH agents. An OCF 1.1 agent’s metadata must comply with the OCF 1.1 schema. If an OCF 1.1 agent’s metadata does not comply with the OCF 1.1 schema,
pcs
considers the agent invalid and will not create or update a resource of the agent unless the
--force
option is specified. The
pcsd
Web UI and
pcs
commands for listing agents omit OCF 1.1 agents with invalid metadata from the listing.
An OCF agent that declares that it implements any OCF version other than 1.1, or does not declare a version at all, is validated against the OCF 1.0 schema. Validation issues are reported as warnings, but for those agents it is not necessary to specify the
--force
option when creating or updating a resource of the agent.
(
BZ#1936833
)
New fencing agent for OpenShift
The
fence_kubevirt
fencing agent is now available for use with RHEL High Availability on Red Hat OpenShift Virtualization. For information on the
fence_kubevirt
agent, see the
fence_kubevirt
(8) man page.
(
BZ#1977588
)
4.12. Dynamic programming languages, web and database servers
A new module stream:
php:8.0
RHEL 8.6 adds
PHP 8.0
, which provides a number of bug fixes and enhancements over version 7.4
Notable enhancements include:
New named arguments are order-independent and self-documented, and enable you to specify only required parameters.
New attributes enable you to use structured metadata with PHP’s native syntax.
New union types enable you to use native union type declarations that are validated at runtime instead of PHPDoc annotations for a combination of types.
Internal functions now more consistently raise an Error exception instead of warnings if parameter validation fails.
The Just-In-Time compilation has improved the performance.
The
Xdebug
debugging and productivity extension for PHP has been updated to version 3. This version introduces major changes in functionality and configuration compared to
Xdebug 2
.
To install the
php:8.0
module stream, use:
# yum module install php:8.0
If you want to upgrade from the
php:7.4
stream, see
Switching to a later stream
.
For details regarding PHP usage on RHEL 8, see
Using the PHP scripting language
.
(BZ#1978356, BZ#2027285)
A new module stream:
perl:5.32
RHEL 8.6 introduces
Perl 5.32
, which provides a number of bug fixes and enhancements over
Perl 5.30
distributed in RHEL 8.3.
Notable enhancement include:
Perl
now supports unicode version 13.0.
The
qr
qoute-like operator has been enhanced.
The
POSIX::mblen()
,
mbtowc
, and
wctomb
functions now work on shift state locales and are thread-safe on C99 and above compilers when executed on a platform that has locale thread-safety; the length parameters are now optional.
The new experimental
isa
infix operator tests whether a given object is an instance of a given class or a class derived from it.
Alpha assertions are no longer experimental.
Script runs are no longer experimental.
Feature checks are now faster.
Perl
can now dump compiled patterns before optimization.
To upgrade from an earlier
perl
module stream, see
Switching to a later stream
.
(
BZ#2021471
)
A new package:
nginx-mod-devel
A new
nginx-mod-devel
package has been added to the
nginx:1.20
module stream. The package provides all necessary files, including RPM macros and
nginx
source code, for building external dynamic modules for
nginx
.
(
BZ#1991787
)
MariaDB Galera now includes an upstream version of the
garbd
systemd service and a wrapper script
MariaDB 10.3 and MariaDB 10.5 in RHEL 8 include a Red Hat version of
garbd
systemd service and a wrapper script for the
galera
package in the
/usr/lib/systemd/system/garbd.service
and
/usr/sbin/garbd-wrapper
files, respectively.
In addition to the Red Hat version of these files, RHEL 8 now also provides an upstream version. The upstream files are located at
/usr/share/doc/galera/garb-systemd
and
/usr/share/doc/galera/garbd.service
.
RHEL 9 provides only the upstream version of these files, located at
/usr/lib/systemd/system/garbd.service
and
/usr/sbin/garb-systemd
.
(
BZ#2042306
,
BZ#2042298
,
BZ#2050543
,
BZ#2050546
)
4.13. Compilers and development tools
New command for capturing
glibc
optimization data
The new
ld.so --list-diagnostics
command captures data that influences
glibc
optimization decisions, such as IFUNC selection and
glibc-hwcaps
configuration, in a single machine-readable file.
(
BZ#2023420
)
glibc
string functions are now optimized for Fujitsu A64FX
With this update,
glibc
string functions exhibit increased throughput and reduced latency on A64FX CPUs.
(BZ#1929928)
New UTF-8 locale
en_US@ampm
with 12-hour clock
With this update, you can now use a new UTF-8 locale
en_US@ampm
with a 12-hour clock. This new locale can be combined with other locales by using the
LC_TIME
environment variable.
(
BZ#2000374
)
New location for
libffi
's self-modifying code
With this update
libffi
's self-modifying code takes advantage of a feature in the RHEL 8 kernel to create a suitable file independent of any file system. As a result,
libffi
's self-modifying code no longer depends on making part of the filesystem insecure.
(
BZ#1875340
)
Updated GCC Toolset 11
GCC Toolset 11 is a compiler toolset that provides recent versions of development tools. It is available as an Application Stream in the form of a Software Collection in the
AppStream
repository.
Notable changes introduced with RHEL 8.6 include:
The GCC compiler has been updated to version 11.2.1.
annobin
has been updated to version 10.23.
The following tools and versions are provided by GCC Toolset 10:
| Tool | Version | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
11.2.1 Valgrind 3.17.0 SystemTap Dyninst 11.0.0 binutils 2.36.1 elfutils 0.185 strace ltrace 0.7.91 annobin 10.23 To install GCC Toolset 11, run the following command as root: # yum install gcc-toolset-11 To run a tool from GCC Toolset 11: $ scl enable gcc-toolset-11 tool
To run a shell session where tool versions from GCC Toolset 11 override system versions of these tools: $ scl enable gcc-toolset-11 bash
For more information about usage, see
Using GCC Toolset
.
The GCC Toolset 11 components are available in the two container images:
# podman pull registry.redhat.io/<image_name> Note that only the GCC Toolset 11 container images are now supported. Container images of earlier GCC Toolset versions are deprecated. For details regarding the container images, see Using the GCC Toolset container images . ( BZ#1996862 ) GDB disassembler now supports the new arch14 instructions With this update, GDB is able to disassemble new arch14 instructions. (BZ#2012818) LLVM Toolset rebased to version 13.0.1
LLVM Toolset has been upgraded to version 13.0.1. Notable changes include:
Clang now supports guaranteed tail calls with statement attributes
Rust Toolset rebased to 1.58.1
The
Go Toolset rebased to version 1.17.7 Go Toolset has been upgraded to version 1.17.7. Notable changes include: Added an option to convert slices to array pointers. Added support for //go:build lines. Improvements to function call performance on amd64. Function arguments are formatted more clearly in stack traces. Functions containing closures can be inlined. Reduced resource consumption in x509 certificate parsing. (BZ#2014088)
The
The
The
The
The
Power consumption metrics now available in PCP
The new
A new module:
A new
# yum module install log4j:2 (BZ#1937468) 4.14. Identity Management
Previously in RHEL 8, before installing the
IdM now supports the
With this update, the
The support for managing subID ranges is available in the shadow-utils
Previously,
An alternative to the traditional RHEL ansible-freeipa repository: Ansible Automation Hub
With this update, you can download
ansible-freeipa modules can now be executed remotely on IdM clients
Previously,
The
With this update, excluding global forwarders in Identity Management (IdM) by using the
Identity Management now supports SHA384withRSA signing by default With this update, the Certificate Authority (CA) in IdM supports the SHA-384 With RSA Encryption signing algorithm. SHA384withRSA is compliant with the Federal Information Processing Standard (FIPS). ( BZ#1731484 ) SSSD default SSH hashing value is now consistent with the OpenSSH setting
The default value of
samba rebased to version 4.15.5
The
samba
packages have been upgraded to upstream version 4.15.5, which provides bug fixes and enhancements over the previous version:
Options in Samba utilities have been renamed and removed for a consistent user experience
Server multi-channel support is now enabled by default.
The
Directory Server rebased to version 1.4.3.28
The
Directory Server now stores memory-mapped files of databases on a
In Directory Server, the
4.15. DesktopSecurity classification banners at login and in the desktop session You can now configure classification banners to state the overall security classification level of the system. This is useful for deployments where the user must be aware of the security classification level of the system that they are logged into. The classification banners can appear in the following contexts, depending on your configuration: Within the running session On the lock screen On the login screen The classification banners can take the form of either a notification that you can dismiss, or a permanent banner. For more information, see Displaying the system security classification . ( BZ#1751336 ) 4.16. Graphics infrastructuresIntel Alder Lake-P GPUs are now supported This release adds support for the Intel Alder Lake-P CPU microarchitecture with integrated graphics. This includes Intel UHD Graphics and Intel Xe integrated GPUs found with the following CPU models: Intel Core i7-1280P Intel Core i7-1270P Intel Core i7-1260P Intel Core i5-1250P Intel Core i5-1240P Intel Core i3-1220P Support for Alder Lake-P graphics is disabled by default. To enable it, add the following option to the kernel command line: i915.force_probe=PCI_ID
Replace
PCI_ID
with either the PCI device ID of your Intel GPU, or with the
4.17. The web consoleSmart card authentication for sudo and SSH from the web console Previously, it was not possible to use smart card authentication to obtain sudo privileges or use SSH in the web console. With this update, Identity Management users can use a smart card to gain sudo privileges or to connect to a different host with SSH. It is only possible to use one smart card to authenticate and gain sudo privileges. Using a separate smart card for sudo is not supported. (JIRA:RHELPLAN-95126) RHEL web console provides Insights registration by default With this update, when you use the Red Hat Enterprise Linux web console to register a RHEL system, the Connect this system to Red Hat Insights. check box is checked by default. If you do not want to connect to the Insights service, uncheck the box. ( BZ#2049441 ) Cockpit now supports using an existing TLS certificate
With this enhancement, the certificate does not have strict file permission requirements any more (such as
4.18. Red Hat Enterprise Linux System RolesThe Firewall RHEL System Role has been added in RHEL 8
The
Full Support for HA Cluster RHEL System Role The High Availability Cluster (HA Cluster) role, previously available as a Technology Preview, is now fully supported. The following notable configurations are available: Configuring fence devices, resources, resource groups, and resource clones including meta attributes and resource operations Configuring resource location constraints, resource colocation constraints, resource order constraints, and resource ticket constraints Configuring cluster properties Configuring cluster nodes, custom cluster names and node names Configuring multi-link clusters Configuring whether clusters start automatically on boot Running the role removes any configuration not supported by the role or not specified when running the role. The HA Cluster System Role does not currently support SBD. ( BZ#1893743 ) The Networking System Role now supports OWE Opportunistic Wireless Encryption (OWE) is a mode of opportunistic security for Wi-Fi networks that provides encryption of the wireless medium but no authentication, such as public hot spots. OWE uses encryption between Wi-Fi clients and access points, protecting them from sniffing attacks. With this enhancement, the Networking RHEL System role supports OWE. As a result, administrators can now use the Networking System Role to configure connections to Wi-Fi networks which use OWE. ( BZ#1993379 ) The Networking System Role now supports SAE In Wi-Fi protected access version 3 (WPA3) networks, the simultaneous authentication of equals (SAE) method ensures that the encryption key is not transmitted. With this enhancement, the Networking RHEL System role supports SAE. As a result, administrators can now use the Networking System Role to configure connections to Wi-Fi networks, which use WPA-SAE. ( BZ#1993311 ) The Cockpit RHEL System Role is now supported With this enhancement, you can install and configure the web console in your system. Consequently, you can manage web console in an automated manner. ( BZ#2021661 )
Add support for
The Storage RHEL System Role can now specify the
The NBDE client System Role supports systems with static IP addresses Previously, restarting a system with a static IP address and configured with the NBDE client System Role would change the system’s IP address. With this change, systems with static IP addresses are supported by the NBDE client System Role, and their IP addresses do not change after a reboot. ( BZ#1985022 ) Support for cached volumes is available in the Storage System Role Storage RHEL System Role can now create and manage cached LVM logical volumes. LVM cache can be used to improve performance of slower logical volumes by temporarily storing subsets of an LV’s data on a smaller, faster device, for example an SSD. ( BZ#2016511 )
Support to add
This update adds the
Ansible Core support for the RHEL System Roles As of RHEL 8.6 GA release, Ansible Core is provided, with a limited scope of support, to enable RHEL supported automation use cases. Ansible Core replaces Ansible Engine which was previously provided in a separate repository. Ansible Core is available in the AppStream repository for RHEL. For more details on the supported use cases, see Scope of support for the Ansible Core package included in the RHEL 9 and RHEL 8.6 and later AppStream repositories . Users must manually migrate their systems from Ansible Engine to Ansible Core. For details on that, see Using Ansible in RHEL 8.6 and later . ( BZ#2012316 )
The
This update adds support for both the
The Certificate role consistently uses "Ansible_managed" comment in its hook scripts
With this enhancement, the Certificate role generates pre-scripts and post-scripts to support providers, to which the role inserts the "Ansible managed" comment using the Ansible standard "ansible_managed" variable:
The Terminal session recording System Role uses the "Ansible managed" comment in its managed configuration files
The Terminal session recording role generates 2 configuration files:
Microsoft SQL System Role now supports customized repository for disconnected or Satellite subscriptions
Previously, users in disconnected environments that needed to pull packages from a custom server or Satellite users that needed to point to Satellite or Capsule had no support from Microsoft SQL Role . This update fixes it, by enabling users to provide a customized URL to use for
The Microsoft SQL System Role consistently uses "Ansible_managed" comment in its managed configuration files
The
Support to all bonding options added to the Networking System Role This update provides support to all bonding options to the Networking RHEL System Role. Consequently, it enables you to flexibly control the network transmission over the bonded interface. As a result, you can control the network transmission over the bonded interface by specifying several options to that interface. ( BZ#2008931 ) NetworkManager supports specifying a network card using its PCI address Previously, during setting a connection profile, NetworkManager was only allowed to specify a network card using either its name or MAC address. In this case, the device name is not stable and the MAC address requires inventory to maintain record of used MAC addresses. Now, you can specify a network card based on its PCI address in a connection profile. (BZ#1695634)
A new option
Previously, the
The VPN role consistently uses
The VPN role generates the following configuration file:
New
You can now use the
The Networking System Role now uses the ‘Ansible managed’ comment in its managed configuration files
When using the
The Firewall System Role now supports setting the firewall default zone
You can now set a default firewall zone in the Firewall System role. Zones represent a concept to manage incoming traffic more transparently. The zones are connected to networking interfaces or assigned a range of source addresses. Firewall rules for each zone are managed independently enabling the administrator to define complex firewall settings and apply them to the traffic. This feature allows setting the default zone used as the default zone to assign interfaces to, same as
The Metrics System Role now generates files with the proper
Previously, the Metrics role did not add an
The Postfix System Role now generates files with the proper
Previously, the Postfix role did not add an
4.19. VirtualizationMediated devices are now supported by virtualization CLIs on IBM Z
Using
Virtualization support for Intel Atom P59 series processors
With this update, virtualization on RHEL 8 adds support for the Intel Atom P59 series processors, formerly known as Snow Ridge. As a result, virtual machines hosted on RHEL 8 can now use the
ESXi hypervisor and SEV-ES is now fully supported You can now enable the AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES) to secure RHEL virtual machines (VMs) on VMware’s ESXi hypervisor, versions 7.0.2 and later. This feature was previously introduced in RHEL 8.4 as a Technology Preview. It is now fully supported. (BZ#1904496) Windows 11 and Windows Server 2022 guests are supported RHEL 8 now supports using Windows 11 and Windows Server 2022 as the guest operating systems on KVM virtual machines. (BZ#2036863, BZ#2004162) 4.20. RHEL in cloud environmentsRHEL 8 virtual machines are now supported on certain ARM64 hosts on Azure Virtual machines that use RHEL 8.6 or later as the guest operating system are now supported on Microsoft Azure hypervisors running on Ampere Altra ARM-based processors. (BZ#1949614) New SSH module for cloud-init
With this update, an SSH module has been added to the
ssh_genkeytypes: ['rsa', 'ecdsa', 'ed25519']
/etc/ssh/ssh_host_*
files exist in the instance.
If the
/etc/ssh/ssh_host_*
files do not exist, use the following command to generate host keys:
cloud-init single --name cc_ssh Restart the sshd service: systemctl restart sshd (BZ#2115791)
The
With this update, the
4.21. Supportability
A new package:
RHEL 8 introduces the
This
The
When using
The
4.22. Containers
The
The NFS storage is now available You can now use the NFS file system as a backend storage for containers and images if your file system has xattr support. (JIRA:RHELPLAN-75169)
The
The
Universal Base Images are now available on Docker Hub Previously, Universal Base Images were only available from the Red Hat container catalog. With this enhancement, Universal Base Images are also available from Docker Hub as a Verified Publisher image . (JIRA:RHELPLAN-101137)
A
The
Podman now supports auto-building and auto-running pods using a YAML file
The
Podman now has ability to source subUID and subGID ranges from IdM
The subUID and subGID ranges can now be managed by IdM. Instead of deploying the same
The
The
Netavark network stack is now available The new network stack available starting with Podman 4.1.1-7 consists of two tools, the Netavark network setup tool and the Aardvark DNS server. The Netavark stack, previously available as a Technology Preview, is with the release of the RHBA-2022:7127 advisory fully supported. This network stack has the following capabilities: Configuration of container networks using the JSON configuration file Creating, managing, and removing network interfaces, including bridge and MACVLAN interfaces Configuring firewall settings, such as network address translation (NAT) and port mapping rules IPv4 and IPv6 Improved capability for containers in multiple networks Container DNS resolution using the aardvark-dns project You have to use the same version of Netavark stack and the Aardvark authoritative DNS server. (JIRA:RHELPLAN-137623)
Podman now supports the
With the release of the
RHBA-2022:7127
advisory. the
Chapter 5. Important changes to external kernel parameters
This chapter provides system administrators with a summary of significant changes in the kernel shipped with Red Hat Enterprise Linux 8.6. These changes could include for example added or updated
New kernel parameters
Updated kernel parameters
Format: <int>
Format: <byte> or <bitmap-list>
Due to the existence of
Format: <name of the controller(s) or feature(s) to disable>
With this parameter you can disable a particular controller or optional feature.
The effects of
arch/x86/include/asm/cpufeatures.h
for the valid bit numbers. Linux specific bits are not necessarily stable over kernel options, but the vendor specific ones should be. User programs calling CPUID directly or using the feature without checking anything will still see it. This just prevents it from being used by the kernel or shown in
/proc/cpuinfo
. Also note the kernel could malfunction if you disable some critical bits.
Format: <"0" | "1"> With this parameter you can configure translation look-aside buffer (TLB) invalidation behavior. Possible values are: 0 - lazy mode, requests that use of Direct Memory Access (DMA) unmap operations is deferred 1 - strict mode (default), DMA unmap operations invalidate IOMMU hardware TLBs synchronously. On AMD64 and Intel 64, the default behavior depends on the equivalent driver-specific parameters. However, a strict mode explicitly specified by either method takes precedence.
If this parameter is set to zero, it moves all
This parameter enables to use only normal grace-period primitives once boot has completed. That is after the
With this parameter you can control mitigation of Spectre variant 2 (indirect branch speculation) vulnerability.
The default operation protects the kernel from user space attacks.
Possible values are:
on - unconditionally enable, implies
Chapter 6. Device Drivers6.1. New driversNetwork drivers
Graphics drivers and miscellaneous drivers
6.2. Updated driversNetwork drivers
Storage drivers
Graphics and miscellaneous driver updates
Chapter 7. Bug fixesThis part describes bugs fixed in Red Hat Enterprise Linux 8.6 that have a significant impact on users. 7.1. Installer and image creation
The
Previously, the
Users can now specify user accounts in the RHEL for Edge Installer blueprint
Previously, performing an update on your blueprint without a user account defined in the RHEL for Edge Commit for the upgrade, such as adding a rpm package, would cause users to be locked out of their system, after the upgrade was applied. It caused users to have redefine user accounts when upgrading an existing system. This issue has been fixed to allow users to specify user accounts in the RHEL for Edge Installer blueprint, that creates a user on the system at installation time, rather than having the user as part of the
Image Builder users can create a customized image by adding additional packages. If the total size of the packages and their dependencies exceeded 4GB size, users of RHEL 8.5 and earlier releases would see the following error: ubprocess.CalledProcessError: Command '['/usr/bin/xorrisofs', '-verbose', '-V', 'RHEL-8-5-0-BaseOS-x86_64', '-sysid', 'LINUX', '-isohybrid-mbr', '/usr/share/syslinux/isohdpfx.bin', '-b', 'isolinux/isolinux.bin', '-c', 'isolinux/boot.cat', '-boot-load-size', '4', '-boot-info-table', '-no-emul-boot', '-rock', '-joliet', '-eltorito-alt-boot', '-e', 'images/efiboot.img', '-no-emul-boot', '-isohybrid-gpt-basdat', '-o', '/run/osbuild/tree/installer.iso', '/run/osbuild/inputs/tree']' returned non-zero exit status 32.
The problem happened because the ISO 9660 Level Of Interchange
7.2. Software management
Running
Previously, when running the
7.3. Shells and command-line tools
Errors during the installation of the
Previously the
Previously,
ERROR: LVM 'lvmdev' entry in /var/lib/rear/layout/disklayout.conf where volume_group or device is empty or more than one word
With this update,
Previously,
7.4. SecurityRemote users are no longer repetitively prompted to access smart cards
Previously, the
64-bit IBM Z systems no longer become unbootable when installing in FIPS mode
Previously, the
Previously, the
Previously,
STIG-specific default banner text removed from other profiles Previously, banner text from the STIG profile was used as default by other profiles that did not have a default text defined, such as CIS. As a consequence, systems using these profiles were configured with the specific text required by DISA. With this update, a generic default text was created and a standard CIS banner aligned with the guidelines was defined. As a result, profiles based on guidelines which explicitly require a text banner are now aligned with the requirements and set the correct text. ( BZ#1983061 ) ANSSI Enhanced Profile correctly selects the "Ensure SELinux State is Enforcing" rule
Previously, the ANSSI Enhanced profile (
Descriptions for
Previously, descriptions for rules "Record Any Attempts to Run restorecon" (CCE-80699-2) and "Record Any Attempts to Run seunshare" (CCE-80933-5) were incorrect. With this update, the descriptions of these rules are aligned with the automated OVAL check. As a result, applying the fix recommended in the description now correctly fixes these rules. ( BZ#2023569 ) The CIS profile no longer automatically disables IPv6
Previously, the CIS profile for RHEL 8 provided inappropriate automated remediation for recommendation “3.6 Disable IPv6”, which disabled IPv6 by configuring
CIS profile no longer blocks the SSH service
Previously, the
Files in
Previously, according to the description of SCAP rules
ANSSI Kickstart now reserves enough disk space
Previously, GUI installation required more disk space than ANSSI Kickstart reserved in the
Remediations of GRUB2 arguments are now persistent
Previously, the remediations for GRUB2 rules that set kernel arguments were using incorrect procedures and the configuration changes were not persistent across kernel upgrades. As a consequence, the remediations had to be reapplied with every kernel upgrade. With this update, remediations use the
Previously, sending content files to the scanned system would hang and the
Previously, the
Ambient capabilities are now applied correctly to non-root users
As a safety measure, changing a UID (User Identifier) from root to non-root nullifies permitted, effective, and ambient sets of capabilities.
However, the
The
Previously, the
Previously, the
Clevis no longer stops on certain configurations before automated unlocking Previously, the Clevis utility, which performs automated unlocking of LUKS-encrypted volumes, stopped on certain system configurations. Consequently, encrypted volumes were not unlocked automatically, and the administrator had to provide a passphrase manually. In some cases, Clevis restarted after the administrator pressed Enter and unlocked the encrypted volumes. With this update, the utility has been fixed to not stop on these configurations, and the process of automated unlocking now works properly. (BZ#2018292) 7.5. NetworkingNetworkManager now uses a static IPv4 IP address as primary
The main purpose of primary and secondary addresses is to enable source address selection for connections that are not yet bound to an IP address. For these connections, the kernel automatically chooses an address. In a NetworkManager connection profile, you can configure a static IPv4 address and DHCP at the same time for one connection. Previously, if you configured a connection with DHCP and a static IPv4 address from the same range as the one provided by the DHCP server, NetworkManager incorrectly assigned the IP address that it received from the DHCP server as primary and the static IP address as secondary.
RHEL 8.6 changes this to the intended behavior. As a result, if you configure both a static IPv4 address and DHCP in one connection profile, the static IP address is now always the primary and the address received from the DHCP server the secondary. Additionally, NetworkManager now also sets the
7.6. Kernel
The
Previously, the
Previously,
Tunnel offloading now works as expected and supports the available hardware Previously, the driver was not setting certain feature flags. Hence, tunnel offloading was not working as expected. In this update, the driver sets the required flags to enable tunnel offloading and works as expected. (BZ#1910885)
Fixed the kernel warning while setting the
Previously, an internal function expecting clean input was called with a reused and already initialized structure. It caused the kernel to give the warning message: “missing unregister, handled but fix driver”. This update fixes the bug, reinitializing the structure before trying to register it again. (BZ#2040171) 7.7. File systems and storage
Previously, while restoring a backup created using the
# xfsdump -L test -M test -f /scratch.dmp /mnt/test xfsdump: NOTE: root ino 128 differs from mount dir ino 1024, bind mount? xfsdump: Dump Status: SUCCESS # xfsrestore -f /scratch.dmp /mnt/restore/ xfsrestore: restoring non-directory files xfsrestore: NOTE: ino 128 salvaging file, placing in orphanage/1024.0/dir17/file60 xfsrestore: NOTE: ino 129 salvaging file, placing in orphanage/1024.0/dir17/file61 xfsrestore: NOTE: ino 130 salvaging file, placing in orphanage/1024.0/dir17/file62 xfsrestore: NOTE: ino 131 salvaging file, placing in orphanage/1024.0/dir17/file63 xfsrestore: NOTE: ino 132 salvaging file, placing in orphanage/1024.0/dir17/file64 xfsrestore: NOTE: ino 133 salvaging file, placing in orphanage/1024.0/dir17/file65 xfsrestore: NOTE: ino 134 salvaging file, placing in orphanage/1024.0/dir17/file66 With this update, the problem has been fixed and 7.8. Compilers and development tools
The
Previously, when you added the
Statically linked applications no longer crash
Previously, the initialization code of the dynamic loader, which is linked into statically linked binaries, did not initialize a link map variable correctly. Consequently, statically linked applications crashed if
Previously, the
7.9. Identity Management
Certmonger can now automatically renew SCEP certificates with AD when
Previously, requests for renewal of SCEP certificates sent by
[scep] challenge_password_otp = yes Restart certmonger: # systemctl restart certmonger ( BZ#1577570 ) FreeRADIUS proxy server no longer stops working when a second FreeRADIUS server is unavailable When a FreeRADIUS server is configured as a proxy server it forwards request messages to another FreeRADIUS server. Previously, if the connection between these two servers was interrupted, the FreeRADIUS proxy server stopped working. With this fix, the FreeRADIUS proxy server is now able to reestablish a connection when the other server becomes available. ( BZ#2030173 ) Authenticating to Directory Server in FIPS mode with PBKDF2-hashed passwords now works as expected
When Directory Server runs in Federal Information Processing Standard (FIPS) mode, the
Socket activation of SSSD succeeds when the SSSD cache is mounted in tmpfs as the SSSD user
Previously, socket activation of SSSD would fail if the SSSD cache was mounted in a
Warning
Perform the following steps only if you have mounted your SSSD cache into
Procedure
Verification
(BZ#2108316) 7.10. Graphics infrastructuresMatrox GPU with a VGA display now works as expected
Prior to this release, your display showed no graphical output if you used the following system configuration:
A GPU in the Matrox MGA G200 family
A display connected over the VGA controller
UEFI switched to legacy mode
As a consequence, you could not use or install RHEL on this configuration.
With this update, the
7.11. Red Hat Enterprise Linux System Roles
A playbook using the Metrics role completes successfully on multiple runs even if the Grafana
Previously, changes to the Grafana
The SSHD System Role uses the correct template file
In RHEL 8.5, the SSHD System Role used a wrong template file. As a consequence, the generated
The Networking System Role no longer fails to set a DNS search domain if IPv6 is disabled
Previously, the
nm-connection-error-quark: ipv6.dns-search: this property is not allowed for 'method=ignore' (7)
With this update, the
The
Previously, if you used the
The SSH server role now detects FIPS mode and handles tasks correctly in FIPS mode
Previously, when managing RHEL8 and older systems in FIPS mode, one of the default hostkeys was not allowed to be created. As a consequence, the SSH server role operation failed to generate the
The Logging System Role no longer calls tasks multiple times Previously, the Logging role was calling tasks multiple times that should have been called only once. As a consequence, the extra task calls slowed down the execution of the role. With this fix, the Logging role was changed to call the tasks only once, improving the Logging role performance. ( BZ#2005727 )
RHEL System Roles now handle multi-line
Previously, some of the RHEL System Roles were using
The Logging role no longer misses quotes for the
Previously, the "interval" field value for the
The
Previously, when setting the group for a certificate, the
The
Previously, the Kernel settings RHEL System Role had a hard-coded value for the
The
Previously, the
Fixed a typo to support
Previously, there was a typo,
Configuration by the Metrics role now follows symbolic links correctly
When the
The Kernel settings System Role now correctly installs
Previously, the Kernel settings role returned an error that the
The Kdump System Role does not ignore hosts anymore
Previously, the Kdump role ignored managed nodes that do not have memory reserved for crash kernel, and consequently completed with the “Success” status even when not configuring the system correctly. The role has been redesigned to fail in cases where managed nodes do not have memory reserved for crash kernel, and to prompt the user to set the
The Firewall System Role now reloads the firewall immediately when
Previously, the Firewall System Role was not reloading the firewall when the
Default
Previously, when a user ran the HA Cluster System Role with the default
7.12. Virtualization
Previously, when the
Previously, attempting to migrate a virtual machine (VM) using the
VM migration and snapshots no longer failing due to
Previously, attempting to migrate a virtual machine (VMs) with a more recent guest operating system (such as RHEL 9) failed if the VM was using the
Hot unplugging an IBMVFC device on PowerVM now works as expected
Previously, when using a virtual machine (VM) with a RHEL 8 guest operating system on the PowerVM hypervisor, attempting to remove an IBM Power Virtual Fibre Channel (IBMVFC) device from the running VM failed. Instead, it displayed an
7.13. ContainersRootless containers created in RHEL 8.5 and earlier using fuse-overlayfs now recognize removed files Previously, in RHEL 8.4 and earlier, rootless images and containers were created or stored using the fuse-overlayfs file system. Using such images and containers in RHEL 8.5 and later introduced problems for unprivileged users using the overlayfs implementation provided by the kernel and who had removed files or directories from a container or from an image in RHEL 8.4. This problem did not apply to containers created by the root account. As a consequence, files or directories that were removed from a container or from an image were marked as such using the whiteout format when using the fuse-overlayfs file system. However, due to differences in the format, the kernel overlayfs implementation did not recognize the whiteout format created by fuse-overlayfs. As a result, any removed files or directories still appeared. This problem did not apply to containers created by the root account. With this update, the problem is solved. (JIRA:RHELPLAN-92741) Chapter 8. Technology PreviewsThis part provides a list of all Technology Previews available in Red Hat Enterprise Linux 8.6. For information on Red Hat scope of support for Technology Preview features, see Technology Preview Features Support Scope . 8.1. RHEL for EdgeFDO process available as a Technology Preview The FDO process for automatic provisioning and onboarding RHEL for Edge images is available as a Technology Preview. With that, you can build a RHEL for Edge Simplified Installer image, provision it to a RHEL for Edge image, and use the FDO (FIDO device onboarding) process to automatically provision and onboard your Edge devices, exchange data with other devices and systems connected on the networks. As a result, the FIDO device onboarding protocol performs device initialization at the manufacturing stage and then late binding to actually use the device. (BZ#1989930) 8.2. Shells and command-line toolsReaR available on the 64-bit IBM Z architecture as a Technology Preview
Basic Relax and Recover (ReaR) functionality is now available on the 64-bit IBM Z architecture as a Technology Preview. You can create a ReaR rescue image on IBM Z only in the z/VM environment. Backing up and recovering logical partitions (LPARs) has not been tested.
The only output method currently available is Initial Program Load (IPL). IPL produces a kernel and an initial ramdisk (initrd) that can be used with the
Warning
Currently, the rescue process reformats all the DASDs (Direct Attached Storage Devices) connected to the system. Do not attempt a system recovery if there is any valuable data present on the system storage devices. This also includes the device prepared with the
8.3. Networking
XDP features that are available as Technology Preview
Red Hat provides the usage of the following eXpress Data Path (XDP) features as unsupported Technology Preview:
Loading XDP programs on architectures other than AMD and Intel 64-bit. Note that the
Multi-protocol Label Switching for TC available as a Technology Preview
The Multi-protocol Label Switching (MPLS) is an in-kernel data-forwarding mechanism to route traffic flow across enterprise networks. In an MPLS network, the router that receives packets decides the further route of the packets based on the labels attached to the packet. With the usage of labels, the MPLS network has the ability to handle packets with particular characteristics. For example, you can add
# tc filter add dev enp0s1 ingress protocol mpls_uc flower mpls lse depth 1 label 12323 lse depth 2 label 45832 \ action mpls dec_ttl pipe \ action mpls modify label 549386 pipe \ action pedit ex munge eth dst set 00:00:5E:00:53:01 pipe \ action pedit ex munge eth src set 00:00:5E:00:53:02 pipe \ action mirred egress redirect dev enp0s2 (BZ#1814836, BZ#1856415 )
The
The
The
The
# yum install nispor
To install
# yum install nmstate
8.4. Kernel
The
The
The
The
SGX available as a Technology Preview Software Guard Extensions (SGX) is an Intel® technology for protecting software code and data from disclosure and modification. The RHEL kernel partially provides the SGX v1 and v1.5 functionality. The version 1 enables platforms using the Flexible Launch Control mechanism to use the SGX technology. (BZ#1660337) eBPF available as a Technology Preview
Extended Berkeley Packet Filter (eBPF)
is an in-kernel virtual machine that allows code execution in the kernel space, in the restricted sandbox environment with access to a limited set of functions.
The virtual machine includes a new system call
The Intel data streaming accelerator driver for kernel is available as a Technology Preview The Intel data streaming accelerator driver (IDXD) for the kernel is currently available as a Technology Preview. It is an Intel CPU integrated accelerator and includes a shared work queue with process address space ID (pasid) submission and shared virtual memory (SVM). (BZ#1837187) Soft-RoCE available as a Technology Preview
Remote Direct Memory Access (RDMA) over Converged Ethernet (RoCE) is a network protocol that implements RDMA over Ethernet. Soft-RoCE is the software implementation of RoCE which maintains two protocol versions, RoCE v1 and RoCE v2. The Soft-RoCE driver,
The
Red Hat provides the usage of
8.5. File systems and storageFile system DAX is now available for ext4 and XFS as a Technology Preview
In Red Hat Enterprise Linux 8, the file system DAX is available as a Technology Preview. DAX provides a means for an application to directly map persistent memory into its address space. To use DAX, a system must have some form of persistent memory available, usually in the form of one or more Non-Volatile Dual In-line Memory Modules (NVDIMMs), and a file system that provides the capability of DAX must be created on the NVDIMM(s). Also, the file system must be mounted with the
OverlayFS
OverlayFS is a type of union file system. It enables you to overlay one file system on top of another. Changes are recorded in the upper file system, while the lower file system remains unmodified. This allows multiple users to share a file-system image, such as a container or a DVD-ROM, where the base image is on read-only media.
OverlayFS remains a Technology Preview under most circumstances. As such, the kernel logs warnings when this technology is activated.
Full support is available for OverlayFS when used with supported container engines (
# xfs_info /mount-point | grep ftype
Stratis is now available as a Technology Preview
Stratis is a new local storage manager. It provides managed file systems on top of pools of storage with additional features to the user.
Stratis enables you to more easily perform storage tasks such as:
Manage snapshots and thin provisioning
Automatically grow file system sizes as needed
Maintain file systems
To administer Stratis storage, use the
Setting up a Samba server on an IdM domain member is provided as a Technology Preview
With this update, you can now set up a Samba server on an Identity Management (IdM) domain member. The new
NVMe/TCP host is available as a Technology Preview
Accessing and sharing Nonvolatile Memory Express (NVMe) storage over TCP/IP networks (NVMe/TCP) and its corresponding
8.6. High availability and clusters
Pacemaker
Pacemaker container bundles now run on Podman, with the container bundle feature being available as a Technology Preview. There is one exception to this feature being Technology Preview: Red Hat fully supports the use of Pacemaker bundles for Red Hat Openstack. (BZ#1619620)
Heuristics in
Heuristics are a set of commands executed locally on startup, cluster membership change, successful connect to
New
As a Technology Preview, Pacemaker now provides the
Automatic removal of location constraint following resource move available as a Technology Preview
When you execute the
8.7. Identity ManagementIdentity Management JSON-RPC API available as Technology Preview An API is available for Identity Management (IdM). To view the API, IdM also provides an API browser as a Technology Preview. Previously, the IdM API was enhanced to enable multiple versions of API commands. These enhancements could change the behavior of a command in an incompatible way. Users are now able to continue using existing tools and scripts even if the IdM API changes. This enables: Administrators to use previous or later versions of IdM on the server than on the managing client. Developers can use a specific version of an IdM call, even if the IdM version changes on the server. In all cases, the communication with the server is possible, regardless if one side uses, for example, a newer version that introduces new options for a feature. For details on using the API, see Using the Identity Management API to Communicate with the IdM Server (TECHNOLOGY PREVIEW) . ( BZ#1664719 ) DNSSEC available as Technology Preview in IdM Identity Management (IdM) servers with integrated DNS now implement DNS Security Extensions (DNSSEC), a set of extensions to DNS that enhance security of the DNS protocol. DNS zones hosted on IdM servers can be automatically signed using DNSSEC. The cryptographic keys are automatically generated and rotated. Users who decide to secure their DNS zones with DNSSEC are advised to read and follow these documents: DNSSEC Operational Practices, Version 2 Secure Domain Name System (DNS) Deployment Guide DNSSEC Key Rollover Timing Considerations Note that IdM servers with integrated DNS use DNSSEC to validate DNS answers obtained from other DNS servers. This might affect the availability of DNS zones that are not configured in accordance with recommended naming practices. ( BZ#1664718 ) ACME available as a Technology Preview
The Automated Certificate Management Environment (ACME) service is now available in Identity Management (IdM) as a Technology Preview. ACME is a protocol for automated identifier validation and certificate issuance. Its goal is to improve security by reducing certificate lifetimes and avoiding manual processes from certificate lifecycle management.
In RHEL, the ACME service uses the Red Hat Certificate System (RHCS) PKI ACME responder. The RHCS ACME subsystem is automatically deployed on every certificate authority (CA) server in the IdM deployment, but it does not service requests until the administrator enables it. RHCS uses the
Important
It is recommended to enable ACME only in an IdM deployment where all servers are running RHEL 8.4 or later. Earlier RHEL versions do not include the ACME service, which can cause problems in mixed-version deployments. For example, a CA server without ACME can cause client connections to fail, because it uses a different DNS Subject Alternative Name (SAN).
Warning
Currently, RHCS does not remove expired certificates. Because ACME certificates expire after 90 days, the expired certificates can accumulate and this can affect performance.
To enable ACME across the whole IdM deployment, use the
# ipa-acme-manage enable The ipa-acme-manage command was successful
To disable ACME across the whole IdM deployment, use the
# ipa-acme-manage disable The ipa-acme-manage command was successful
To check whether the ACME service is installed and if it is enabled or disabled, use the
# ipa-acme-manage status ACME is enabled The ipa-acme-manage command was successful (BZ#1628987) 8.8. DesktopGNOME for the 64-bit ARM architecture available as a Technology Preview
The GNOME desktop environment is now available for the 64-bit ARM architecture as a Technology Preview. This enables administrators to configure and manage servers from a graphical user interface (GUI) remotely, using the VNC session.
As a consequence, new administration applications are available on the 64-bit ARM architecture. For example:
Disk Usage Analyzer
(
GNOME desktop on IBM Z is available as a Technology Preview The GNOME desktop, including the Firefox web browser, is now available as a Technology Preview on the IBM Z architecture. You can now connect to a remote graphical session running GNOME using VNC to configure and manage your IBM Z servers. (JIRA:RHELPLAN-27737) 8.9. Graphics infrastructuresVNC remote console available as a Technology Preview for the 64-bit ARM architecture On the 64-bit ARM architecture, the Virtual Network Computing (VNC) remote console is available as a Technology Preview. Note that the rest of the graphics stack is currently unverified for the 64-bit ARM architecture. (BZ#1698565) 8.10. The web consoleStratis available as a Technology Preview in the RHEL web console With this update, the Red Hat Enterprise Linux web console provides the ability to manage Stratis storage as a Technology Preview. To learn more about Stratis, see What is Stratis . (JIRA:RHELPLAN-108438) 8.11. VirtualizationAMD SEV and SEV-ES for KVM virtual machines As a Technology Preview, RHEL 8 provides the Secure Encrypted Virtualization (SEV) feature for AMD EPYC host machines that use the KVM hypervisor. If enabled on a virtual machine (VM), SEV encrypts the VM’s memory to protect the VM from access by the host. This increases the security of the VM. In addition, the enhanced Encrypted State version of SEV (SEV-ES) is also provided as Technology Preview. SEV-ES encrypts all CPU register contents when a VM stops running. This prevents the host from modifying the VM’s CPU registers or reading any information from them. Note that SEV and SEV-ES work only on the 2nd generation of AMD EPYC CPUs (codenamed Rome) or later. Also note that RHEL 8 includes SEV and SEV-ES encryption, but not the SEV and SEV-ES security attestation. (BZ#1501618, BZ#1501607, JIRA:RHELPLAN-7677) Intel vGPU
As a Technology Preview, it is now possible to divide a physical Intel GPU device into multiple virtual devices referred to as
Creating nested virtual machines Nested KVM virtualization is provided as a Technology Preview for KVM virtual machines (VMs) running on Intel, AMD64, IBM POWER, and IBM Z systems hosts with RHEL 8. With this feature, a RHEL 7 or RHEL 8 VM that runs on a physical RHEL 8 host can act as a hypervisor, and host its own VMs. (JIRA:RHELPLAN-14047, JIRA:RHELPLAN-24437) Technology Preview: Select Intel network adapters now provide SR-IOV in RHEL guests on Hyper-V
As a Technology Preview, Red Hat Enterprise Linux guest operating systems running on a Hyper-V hypervisor can now use the single-root I/O virtualization (SR-IOV) feature for Intel network adapters that are supported by the
Sharing files between hosts and VMs using virtiofs
As a Technology Preview, RHEL 8 now provides the virtio file system (
KVM virtualization is usable in RHEL 8 Hyper-V virtual machines As a Technology Preview, nested KVM virtualization can now be used on the Microsoft Hyper-V hypervisor. As a result, you can create virtual machines on a RHEL 8 guest system running on a Hyper-V host. Note that currently, this feature only works on Intel and AMD systems. In addition, nested virtualization is in some cases not enabled by default on Hyper-V. To enable it, see the following Microsoft documentation: https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/user-guide/nested-virtualization (BZ#1519039) 8.12. ContainersToolbox is available as a Technology Preview Previously, the Toolbox utility was based on RHEL CoreOS github.com/coreos/toolbox. With this release, Toolbox has been replaced with github.com/containers/toolbox. (JIRA:RHELPLAN-77238) The Netavark network stack is available as a Technology Preview
Before Podman version 4.1.1-7, the Netavark network stack for containers is available as a Technology Preview.
This network stack has the following capabilities:
Configuration of container networks using the JSON configuration file
Creating, managing, and removing network interfaces, including bridge and MACVLAN interfaces
Configuring firewall settings, such as network address translation (NAT) and port mapping rules
IPv4 and IPv6
Improved capability for containers in multiple networks
Container DNS resolution using the
aardvark-dns project
You have to use the same version of Netavark stack and the
Chapter 9. Deprecated functionalityThis part provides an overview of functionality that has been deprecated in Red Hat Enterprise Linux 8. Deprecated functionality will likely not be supported in future major releases of this product and is not recommended for new deployments. For the most recent list of deprecated functionality within a particular major release, refer to the latest version of release documentation. The support status of deprecated functionality remains unchanged within Red Hat Enterprise Linux 8. For information about the length of support, see Red Hat Enterprise Linux Life Cycle and Red Hat Enterprise Linux Application Streams Life Cycle . Deprecated hardware components are not recommended for new deployments on the current or future major releases. Hardware driver updates are limited to security and critical fixes only. Red Hat recommends replacing this hardware as soon as reasonably feasible. A package can be deprecated and not recommended for further use. Under certain circumstances, a package can be removed from a product. Product documentation then identifies more recent packages that offer functionality similar, identical, or more advanced to the one deprecated, and provides further recommendations. For information regarding functionality that is present in RHEL 7 but has been removed in RHEL 8, see Considerations in adopting RHEL 8 . 9.1. Installer and image creationSeveral Kickstart commands and options have been deprecated
Using the following commands and options in RHEL 8 Kickstart files will print a warning in the logs:
The
Using the
The Kickstart
The
9.2. Software management
The
9.3. Shells and command-line tools
The
The
The
The
The ABRT tool has been deprecated
The Automatic Bug Reporting Tool (ABRT) for detecting and reporting application crashes has been deprecated in RHEL 8. As a replacement, use the
The ReaR crontab has been deprecated
The
The
The mount option
The
The
9.4. Security
The Mozilla Network Security Services (
TLS 1.0 and TLS 1.1 are deprecated
The TLS 1.0 and TLS 1.1 protocols are disabled in the
# update-crypto-policies --set LEGACY
For more information, see the
Strong crypto defaults in RHEL 8 and deprecation of weak crypto algorithms
Knowledgebase article on the Red Hat Customer Portal and the
DSA is deprecated in RHEL 8
The Digital Signature Algorithm (DSA) is considered deprecated in Red Hat Enterprise Linux 8. Authentication mechanisms that depend on DSA keys do not work in the default configuration. Note that
The Transport Layer Security (
TPM 1.2 is deprecated The Trusted Platform Module (TPM) secure cryptoprocessor standard version was updated to version 2.0 in 2016. TPM 2.0 provides many improvements over TPM 1.2, and it is not backward compatible with the previous version. TPM 1.2 is deprecated in RHEL 8, and it might be removed in the next major release. (BZ#1657927)
With the introduction of scopes for
Runtime disabling SELinux using
Runtime disabling SELinux using the
The
The
The
9.5. NetworkingNetwork scripts are deprecated in RHEL 8
Network scripts are deprecated in Red Hat Enterprise Linux 8 and they are no longer provided by default. The basic installation provides a new version of the
~]# yum install network-scripts
The
The
The
The
Control group data center bridging exchange daemon (
The
The
The WEP Wi-Fi connection method is deprecated The insecure wired equivalent privacy (WEP) Wi-Fi connection method is deprecated in RHEL 8.6 and will be removed in RHEL 9.0. For secure Wi-Fi connections, use the Wi-Fi Protected Access 3 (WPA3) or WPA2 connection methods. ( BZ#2029338 )
The unsupported
Using the unsupported
9.6. KernelKernel live patching now covers all RHEL minor releases Since RHEL 8.1, kernel live patches have been provided for selected minor release streams of RHEL covered under the Extended Update Support (EUS) policy to remediate Critical and Important Common Vulnerabilities and Exposures (CVEs). To accommodate the maximum number of concurrently covered kernels and use cases, the support window for each live patch will be decreased from 12 to 6 months for every minor, major and zStream version of the kernel. It means that on the day a kernel live patch is released, it will cover every minor release and scheduled errata kernel delivered in the past 6 months. For example, 8.4.x will have a one-year support window, but 8.4.x+1 will have 6 months. For more information about this feature, see Applying patches with kernel live patching . For details about available kernel live patches, see Kernel Live Patch life cycles . ( BZ#1958250 ) Installing RHEL for Real Time 8 using diskless boot is now deprecated Diskless booting allows multiple systems to share a root file system through the network. While convenient, diskless boot is prone to introducing network latency in real-time workloads. With a future minor update of RHEL for Real Time 8, the diskless booting feature will no longer be supported. ( BZ#1748980 )
The Linux
The
The
Software Remote Direct Memory Access over Converged Ethernet (Soft-RoCE), also known as RXE, is a feature that emulates Remote Direct Memory Access (RDMA). In RHEL 8, the Soft-RoCE feature is available as an unsupported Technology Preview. However, due to stability issues, this feature has been deprecated and will be removed in RHEL 9. (BZ#1878207) 9.7. Boot loader
The
In RHEL 8, the kernel command-line parameters for systems using the GRUB2 bootloader were defined in the
9.8. File systems and storage
VDO write modes other than
VDO supports several write modes in RHEL 8:
async-unsafe
async
mode, which complies to Atomicity, Consistency, Isolation, and Durability (ACID). Red Hat does not recommend
async-unsafe
for most use cases and is not aware of any users who rely on it.
This write mode only selects one of the other write modes. It is no longer necessary when VDO supports only a single write mode.
These write modes will be removed in a future major RHEL release.
The recommended VDO write mode is now
async
.
For more information on VDO write modes, see
Selecting a VDO write mode
.
(JIRA:RHELPLAN-70700)
NFSv3 over UDP has been disabled The NFS server no longer opens or listens on a User Datagram Protocol (UDP) socket by default. This change affects only NFS version 3 because version 4 requires the Transmission Control Protocol (TCP). NFS over UDP is no longer supported in RHEL 8. (BZ#1592011)
Due to lack of users, the
VDO manager has been deprecated
The python-based VDO management software has been deprecated and will be removed from RHEL 9. In RHEL 9, it will be replaced by the LVM-VDO integration. Therefore, it is recommended to create VDO volumes using the
The
The
LVM
The LVM
The
9.9. High availability and clusters
The
9.10. Compilers and development tools
The
The
In RHEL 8.1, the 32-bit versions of the GNU Debugger (GDB),
9.11. Identity Management
The
DES and 3DES encryption types have been removed
Due to security reasons, the Data Encryption Standard (DES) algorithm has been deprecated and disabled by default since RHEL 7. With the recent rebase of Kerberos packages, single-DES (DES) and triple-DES (3DES) encryption types have been removed from RHEL 8.
If you have configured services or users to only use DES or 3DES encryption, you might experience service interruptions such as:
Kerberos authentication errors
Standalone use of the
Since RHEL 8.4, customers are advised to use the
Running Samba as a PDC or BDC is deprecated The classic domain controller mode that enabled administrators to run Samba as an NT4-like primary domain controller (PDC) and backup domain controller (BDC) is deprecated. The code and settings to configure these modes will be removed in a future Samba release. As long as the Samba version in RHEL 8 provides the PDC and BDC modes, Red Hat supports these modes only in existing installations with Windows versions which support NT4 domains. Red Hat recommends not setting up a new Samba NT4 domain, because Microsoft operating systems later than Windows 7 and Windows Server 2008 R2 do not support NT4 domains. If you use the PDC to authenticate only Linux users, Red Hat suggests migrating to Red Hat Identity Management (IdM) that is included in RHEL subscriptions. However, you cannot join Windows systems to an IdM domain. Note that Red Hat continues supporting the PDC functionality IdM uses in the background. Red Hat does not support running Samba as an AD domain controller (DC). ( BZ#1926114 ) Indirect AD integration with IdM via WinSync has been deprecated WinSync is no longer actively developed in RHEL 8 due to several functional limitations: WinSync supports only one Active Directory (AD) domain. Password synchronization requires installing additional software on AD Domain Controllers. For a more robust solution with better resource and security separation, Red Hat recommends using a cross-forest trust for indirect integration with Active Directory. See the Indirect integration documentation. (JIRA:RHELPLAN-100400)
The SSSD version of
The SSSD implementation of the
9.12. Desktop
The
The
9.13. Graphics infrastructuresAGP graphics cards are no longer supported Graphics cards using the Accelerated Graphics Port (AGP) bus are not supported in Red Hat Enterprise Linux 8. Use the graphics cards with PCI-Express bus as the recommended replacement. (BZ#1569610) Motif has been deprecated
The Motif widget toolkit has been deprecated in RHEL, because development in the upstream Motif community is inactive.
The following Motif packages have been deprecated, including their development and debugging variants:
9.14. The web consoleThe web console no longer supports incomplete translations The RHEL web console no longer provides translations for languages that have translations available for less than 50 % of the Console’s translatable strings. If the browser requests translation to such a language, the user interface will be in English instead. ( BZ#1666722 ) 9.15. Red Hat Enterprise Linux System Roles
The
The network teaming capabilities have been deprecated in RHEL 9. As a result, using the
Ansible Engine has been deprecated Previous versions of RHEL 8 provided access to an Ansible Engine repository, with a limited scope of support, to enable supported RHEL Automation use cases, such as RHEL System Roles and Insights remedations. Ansible Engine has been deprecated, and Ansible Engine 2.9 will have no support after September 29, 2023. For more details on the supported use cases, see Scope of support for the Ansible Core package included in the RHEL 9 AppStream . Users must manually migrate their systems from Ansible Engine to Ansible Core. For that, follow the steps: Procedure
For more details, see: Using Ansible in RHEL 8.6 and later . ( BZ#2006081 )
The
The
9.16. Virtualization
The
virt-manager has been deprecated The Virtual Machine Manager application, also known as virt-manager , has been deprecated. The RHEL web console, also known as Cockpit , is intended to become its replacement in a subsequent release. It is, therefore, recommended that you use the web console for managing virtualization in a GUI. Note, however, that some features available in virt-manager may not be yet available in the RHEL web console. (JIRA:RHELPLAN-10304) Limited support for virtual machine snapshots Creating snapshots of virtual machines (VMs) is currently only supported for VMs not using the UEFI firmware. In addition, during the snapshot operation, the QEMU monitor may become blocked, which negatively impacts the hypervisor performance for certain workloads. Also note that the current mechanism of creating VM snapshots has been deprecated, and Red Hat does not recommend using VM snapshots in a production environment. ( BZ#1686057 ) The Cirrus VGA virtual GPU type has been deprecated With a future major update of Red Hat Enterprise Linux, the Cirrus VGA GPU device will no longer be supported in KVM virtual machines. Therefore, Red Hat recommends using the stdvga , virtio-vga , or qxl devices instead of Cirrus VGA . (BZ#1651994) KVM on IBM POWER has been deprecated Using KVM virtualization on IBM POWER hardware has become deprecated. As a result, KVM on IBM POWER is still supported in RHEL 8, but will become unsupported in a future major release of RHEL. (JIRA:RHELPLAN-71200) SecureBoot image verification using SHA1-based signatures is deprecated Performing SecureBoot image verification using SHA1-based signatures on UEFI (PE/COFF) executables has become deprecated. Instead, Red Hat recommends using signatures based on the SHA2 algorithm, or later. (BZ#1935497) Using SPICE to attach smart card readers to virtual machines has been deprecated The SPICE remote display protocol has been deprecated in RHEL 8. Since the only recommended way to attach smart card readers to virtual machines (VMs) depends on the SPICE protocol, the usage of smart cards in VMs has also become deprecated in RHEL 8. In a future major version of RHEL, the functionality of attaching smart card readers to VMs will only be supported by third party remote visualization solutions. ( BZ#2059626 ) SPICE has been deprecated The SPICE remote display protocol has become deprecated. Note that SPICE will remain supported in RHEL 8, but Red Hat recommends using alternate solutions for remote display streaming: For remote console access, use the VNC protocol. For advanced remote display functions, use third party tools such as RDP, HP RGS, or Mechdyne TGX. (BZ#1849563) 9.17. ContainersThe Podman varlink-based API v1.0 has been removed The Podman varlink-based API v1.0 was deprecated in a previous release of RHEL 8. Podman v2.0 introduced a new Podman v2.0 RESTful API. With the release of Podman v3.0, the varlink-based API v1.0 has been completely removed. (JIRA:RHELPLAN-45858)
The
The
The container-tools:2.0 module has been deprecated and will no longer receive security updates. It is recommended to use a newer supported stable module stream, such as
9.18. Deprecated packagesThis section lists packages that have been deprecated and will probably not be included in a future major release of Red Hat Enterprise Linux. For changes to packages between RHEL 7 and RHEL 8, see Changes to packages in the Considerations in adopting RHEL 8 document. The following packages have been deprecated and remain supported until the end of life of RHEL 8: 389-ds-base-legacy-tools abrt-addon-ccpp abrt-addon-kerneloops abrt-addon-pstoreoops abrt-addon-vmcore abrt-addon-xorg abrt-cli abrt-console-notification abrt-dbus abrt-desktop abrt-gui abrt-gui-libs abrt-libs abrt-tui adobe-source-sans-pro-fonts adwaita-qt alsa-plugins-pulseaudio amanda amanda-client amanda-libs amanda-server ant-contrib antlr3 antlr32 aopalliance apache-commons-collections apache-commons-compress apache-commons-exec apache-commons-jxpath apache-commons-parent apache-ivy apache-parent apache-resource-bundles apache-sshd apiguardian aspnetcore-runtime-3.0 aspnetcore-runtime-3.1 aspnetcore-runtime-5.0 aspnetcore-targeting-pack-3.0 aspnetcore-targeting-pack-3.1 aspnetcore-targeting-pack-5.0 assertj-core authd autoconf213 autogen autogen-libopts awscli base64coder batik bea-stax bea-stax-api bind-export-devel bind-export-libs bind-libs-lite bind-pkcs11 bind-pkcs11-devel bind-pkcs11-libs bind-pkcs11-utils bind-sdb bind-sdb bind-sdb-chroot bluez-hid2hci boost-jam boost-signals bouncycastle bpg-algeti-fonts bpg-chveulebrivi-fonts bpg-classic-fonts bpg-courier-fonts bpg-courier-s-fonts bpg-dedaena-block-fonts bpg-dejavu-sans-fonts bpg-elite-fonts bpg-excelsior-caps-fonts bpg-excelsior-condenced-fonts bpg-excelsior-fonts bpg-fonts-common bpg-glaho-fonts bpg-gorda-fonts bpg-ingiri-fonts bpg-irubaqidze-fonts bpg-mikhail-stephan-fonts bpg-mrgvlovani-caps-fonts bpg-mrgvlovani-fonts bpg-nateli-caps-fonts bpg-nateli-condenced-fonts bpg-nateli-fonts bpg-nino-medium-cond-fonts bpg-nino-medium-fonts bpg-sans-fonts bpg-sans-medium-fonts bpg-sans-modern-fonts bpg-sans-regular-fonts bpg-serif-fonts bpg-serif-modern-fonts bpg-ucnobi-fonts brlapi-java buildnumber-maven-plugin byaccj cal10n cbi-plugins cdparanoia cdparanoia-devel cdparanoia-libs cdrdao cmirror codehaus-parent codemodel compat-exiv2-026 compat-guile18 compat-hwloc1 compat-libpthread-nonshared compat-libtiff3 compat-openssl10 compat-sap-c++-11 compat-sap-c++-10 compat-sap-c++-9 createrepo_c-devel ctags ctags-etags custodia cyrus-imapd-vzic dbus-c++ dbus-c++-devel dbus-c++-glib dbxtool dhcp-libs dirsplit dleyna-connector-dbus dleyna-core dleyna-renderer dleyna-server dnssec-trigger dnssec-trigger-panel dotnet-apphost-pack-3.0 dotnet-apphost-pack-3.1 dotnet-apphost-pack-5.0 dotnet-host-fxr-2.1 dotnet-host-fxr-2.1 dotnet-hostfxr-3.0 dotnet-hostfxr-3.1 dotnet-hostfxr-5.0 dotnet-runtime-2.1 dotnet-runtime-3.0 dotnet-runtime-3.1 dotnet-runtime-5.0 dotnet-sdk-2.1 dotnet-sdk-2.1.5xx dotnet-sdk-3.0 dotnet-sdk-3.1 dotnet-sdk-5.0 dotnet-targeting-pack-3.0 dotnet-targeting-pack-3.1 dotnet-targeting-pack-5.0 dotnet-templates-3.0 dotnet-templates-3.1 dotnet-templates-5.0 dotnet5.0-build-reference-packages dptfxtract drpm-devel dvd+rw-tools dyninst-static eclipse-ecf eclipse-emf eclipse-license ed25519-java ee4j-parent elfutils-devel-static elfutils-libelf-devel-static enca-devel environment-modules-compat evince-browser-plugin exec-maven-plugin farstream02 felix-osgi-compendium felix-osgi-core felix-osgi-foundation felix-parent file-roller fipscheck fipscheck-devel fipscheck-lib firewire fonts-tweak-tool forge-parent freeradius-mysql freeradius-perl freeradius-postgresql freeradius-sqlite freeradius-unixODBC fuse-sshfs fusesource-pom future gamin gamin-devel gcc-toolset-10 gcc-toolset-10-annobin gcc-toolset-10-binutils gcc-toolset-10-binutils-devel gcc-toolset-10-build gcc-toolset-10-dwz gcc-toolset-10-dyninst gcc-toolset-10-dyninst-devel gcc-toolset-10-elfutils gcc-toolset-10-elfutils-debuginfod-client gcc-toolset-10-elfutils-debuginfod-client-devel gcc-toolset-10-elfutils-devel gcc-toolset-10-elfutils-libelf gcc-toolset-10-elfutils-libelf-devel gcc-toolset-10-elfutils-libs gcc-toolset-10-gcc gcc-toolset-10-gcc-c++ gcc-toolset-10-gcc-gdb-plugin gcc-toolset-10-gcc-gfortran gcc-toolset-10-gdb gcc-toolset-10-gdb-doc gcc-toolset-10-gdb-gdbserver gcc-toolset-10-libasan-devel gcc-toolset-10-libatomic-devel gcc-toolset-10-libitm-devel gcc-toolset-10-liblsan-devel gcc-toolset-10-libquadmath-devel gcc-toolset-10-libstdc++-devel gcc-toolset-10-libstdc++-docs gcc-toolset-10-libtsan-devel gcc-toolset-10-libubsan-devel gcc-toolset-10-ltrace gcc-toolset-10-make gcc-toolset-10-make-devel gcc-toolset-10-perftools gcc-toolset-10-runtime gcc-toolset-10-strace gcc-toolset-10-systemtap gcc-toolset-10-systemtap-client gcc-toolset-10-systemtap-devel gcc-toolset-10-systemtap-initscript gcc-toolset-10-systemtap-runtime gcc-toolset-10-systemtap-sdt-devel gcc-toolset-10-systemtap-server gcc-toolset-10-toolchain gcc-toolset-10-valgrind gcc-toolset-10-valgrind-devel gcc-toolset-9 gcc-toolset-9-annobin gcc-toolset-9-build gcc-toolset-9-perftools gcc-toolset-9-runtime gcc-toolset-9-toolchain gcc-toolset-11-make-devel GConf2 GConf2-devel genisoimage genwqe-tools genwqe-vpd genwqe-zlib genwqe-zlib-devel geoipupdate geronimo-annotation geronimo-jms geronimo-jpa geronimo-parent-poms gfbgraph gflags gflags-devel glassfish-annotation-api glassfish-el glassfish-fastinfoset glassfish-jaxb-core glassfish-jaxb-txw2 glassfish-jsp glassfish-jsp-api glassfish-legal glassfish-master-pom glassfish-servlet-api glew-devel glib2-fam glog-devel gmock gmock-devel gnome-abrt gnome-boxes gnome-menus-devel gnome-online-miners gnome-shell-extension-disable-screenshield gnome-shell-extension-horizontal-workspaces gnome-shell-extension-no-hot-corner gnome-shell-extension-window-grouper gnome-themes-standard gnu-free-fonts-common gnu-free-mono-fonts gnu-free-sans-fonts gnu-free-serif-fonts gnupg2-smime gnuplot gnuplot-common gobject-introspection-devel google-gson google-noto-sans-syriac-eastern-fonts google-noto-sans-syriac-estrangela-fonts google-noto-sans-syriac-western-fonts google-noto-sans-tibetan-fonts google-noto-sans-ui-fonts gphoto2 gsl-devel gssntlmssp gtest gtest-devel gtkmm24 gtkmm24-devel gtkmm24-docs gtksourceview3 gtksourceview3-devel gtkspell gtkspell-devel gtkspell3 guile gutenprint-gimp gutenprint-libs-ui gvfs-afc gvfs-afp gvfs-archive hamcrest-core hawtjni hawtjni hawtjni-runtime highlight-gui hivex-devel hostname hplip-gui httpcomponents-project hwloc-plugins hyphen-fo hyphen-grc hyphen-hsb hyphen-ia hyphen-is hyphen-ku hyphen-mi hyphen-mn hyphen-sa hyphen-tk ibus-sayura icedax icu4j idm-console-framework iptables ipython isl-devel isorelax istack-commons-runtime istack-commons-tools iwl3945-firmware iwl4965-firmware iwl6000-firmware jacoco jakarta-oro janino jansi-native jarjar java-1.8.0-ibm java-1.8.0-ibm-demo java-1.8.0-ibm-devel java-1.8.0-ibm-headless java-1.8.0-ibm-jdbc java-1.8.0-ibm-plugin java-1.8.0-ibm-src java-1.8.0-ibm-webstart java-1.8.0-openjdk-accessibility java-1.8.0-openjdk-accessibility-slowdebug java_cup java-atk-wrapper javacc javacc-maven-plugin javaewah javaparser javapoet javassist javassist-javadoc jaxen jboss-annotations-1.2-api jboss-interceptors-1.2-api jboss-logmanager jboss-parent jctools jdepend jdependency jdom2 jetty jflex jline jnr-netdb jolokia-jvm-agent js-uglify json_simple jss-javadoc jtidy junit5 jvnet-parent jzlib kernel-cross-headers kurdit-unikurd-web-fonts kyotocabinet-libs ldapjdk-javadoc lensfun lensfun-devel lftp-scripts libaec libaec-devel libappindicator-gtk3 libappindicator-gtk3-devel libatomic-static libavc1394 libblocksruntime libcacard libcacard-devel libcgroup libcgroup-tools libchamplain libchamplain-devel libchamplain-gtk libcroco libcroco-devel libcxl libcxl-devel libdap libdap-devel libdazzle-devel libdbusmenu libdbusmenu-devel libdbusmenu-doc libdbusmenu-gtk3 libdbusmenu-gtk3-devel libdc1394 libdnet libdnet-devel libdv libdwarf libdwarf-devel libdwarf-static libdwarf-tools libeasyfc libeasyfc-gobject libepubgen-devel libertas-sd8686-firmware libertas-usb8388-firmware libertas-usb8388-olpc-firmware libgdither libGLEW libgovirt libguestfs-benchmarking libguestfs-devel libguestfs-gfs2 libguestfs-gobject libguestfs-gobject-devel libguestfs-java libguestfs-java-devel libguestfs-javadoc libguestfs-man-pages-ja libguestfs-man-pages-uk libguestfs-tools libguestfs-tools-c libhugetlbfs libhugetlbfs-devel libhugetlbfs-utils libIDL libIDL-devel libidn libiec61883 libindicator-gtk3 libindicator-gtk3-devel libiscsi-devel libjose-devel libkkc libkkc-common libkkc-data libldb-devel liblogging libluksmeta-devel libmalaga libmcpp libmemcached libmemcached-libs libmetalink libmodulemd1 libmongocrypt libmtp-devel libmusicbrainz5 libmusicbrainz5-devel libnbd-devel liboauth liboauth-devel libpfm-static libpng12 libpurple libpurple-devel libraw1394 libreport-plugin-mailx libreport-plugin-rhtsupport libreport-plugin-ureport libreport-rhel libreport-rhel-bugzilla librpmem librpmem-debug librpmem-devel libsass libsass-devel libselinux-python libsqlite3x libtalloc-devel libtar libtdb-devel libtevent-devel libtpms-devel libunwind libusal libvarlink libverto-libevent libvirt-admin libvirt-bash-completion libvirt-daemon-driver-storage-gluster libvirt-daemon-driver-storage-iscsi-direct libvirt-devel libvirt-docs libvirt-gconfig libvirt-gobject libvirt-lock-sanlock libvirt-wireshark libvmem libvmem-debug libvmem-devel libvmmalloc libvmmalloc-debug libvmmalloc-devel libvncserver libwinpr-devel libwmf libwmf-devel libwmf-lite libXNVCtrl libyami log4j12 log4j12-javadoc lohit-malayalam-fonts lohit-nepali-fonts lorax-composer lua-guestfs lucene mailman mailx make-devel malaga malaga-suomi-voikko marisa maven-antrun-plugin maven-assembly-plugin maven-clean-plugin maven-dependency-analyzer maven-dependency-plugin maven-doxia maven-doxia-sitetools maven-install-plugin maven-invoker maven-invoker-plugin maven-parent maven-plugins-pom maven-reporting-api maven-reporting-impl maven-resolver-api maven-resolver-connector-basic maven-resolver-impl maven-resolver-spi maven-resolver-transport-wagon maven-resolver-util maven-scm maven-script-interpreter maven-shade-plugin maven-shared maven-verifier maven-wagon-file maven-wagon-http maven-wagon-http-shared maven-wagon-provider-api maven2 meanwhile mercurial mercurial-hgk metis metis-devel mingw32-bzip2 mingw32-bzip2-static mingw32-cairo mingw32-expat mingw32-fontconfig mingw32-freetype mingw32-freetype-static mingw32-gstreamer1 mingw32-harfbuzz mingw32-harfbuzz-static mingw32-icu mingw32-libjpeg-turbo mingw32-libjpeg-turbo-static mingw32-libpng mingw32-libpng-static mingw32-libtiff mingw32-libtiff-static mingw32-openssl mingw32-readline mingw32-sqlite mingw32-sqlite-static mingw64-adwaita-icon-theme mingw64-bzip2 mingw64-bzip2-static mingw64-cairo mingw64-expat mingw64-fontconfig mingw64-freetype mingw64-freetype-static mingw64-gstreamer1 mingw64-harfbuzz mingw64-harfbuzz-static mingw64-icu mingw64-libjpeg-turbo mingw64-libjpeg-turbo-static mingw64-libpng mingw64-libpng-static mingw64-libtiff mingw64-libtiff-static mingw64-nettle mingw64-openssl mingw64-readline mingw64-sqlite mingw64-sqlite-static modello mojo-parent mongo-c-driver mousetweaks mozjs52 mozjs52-devel mozjs60 mozjs60-devel mozvoikko msv-javadoc msv-manual munge-maven-plugin mythes-mi mythes-ne nafees-web-naskh-fonts nbdkit-devel nbdkit-example-plugins nbdkit-gzip-plugin nbdkit-plugin-python-common nbdkit-plugin-vddk ncompress ncurses-compat-libs net-tools netcf netcf-devel netcf-libs network-scripts network-scripts-ppp nss_nis nss-pam-ldapd objectweb-asm objectweb-asm-javadoc objectweb-pom ocaml-bisect-ppx ocaml-camlp4 ocaml-camlp4-devel ocaml-lwt ocaml-mmap ocaml-ocplib-endian ocaml-ounit ocaml-result ocaml-seq opencryptoki-tpmtok opencv-contrib opencv-core opencv-devel openhpi openhpi-libs OpenIPMI-perl openssh-cavs openssh-ldap openssl-ibmpkcs11 opentest4j os-maven-plugin pakchois pandoc paps-libs paranamer parfait parfait-examples parfait-javadoc pcp-parfait-agent pcp-pmda-rpm pcp-pmda-vmware pcsc-lite-doc peripety perl-B-Debug perl-B-Lint perl-Class-Factory-Util perl-Class-ISA perl-DateTime-Format-HTTP perl-DateTime-Format-Mail perl-File-CheckTree perl-homedir perl-libxml-perl perl-Locale-Codes perl-Mozilla-LDAP perl-NKF perl-Object-HashBase-tools perl-Package-DeprecationManager perl-Pod-LaTeX perl-Pod-Plainer perl-prefork perl-String-CRC32 perl-SUPER perl-Sys-Virt perl-tests perl-YAML-Syck phodav php-recode php-xmlrpc pidgin pidgin-devel pidgin-sipe pinentry-emacs pinentry-gtk pipewire0.2-devel pipewire0.2-libs platform-python-coverage plexus-ant-factory plexus-bsh-factory plexus-cli plexus-component-api plexus-component-factories-pom plexus-components-pom plexus-i18n plexus-interactivity plexus-pom plexus-velocity plymouth-plugin-throbgress powermock prometheus-jmx-exporter prometheus-jmx-exporter-openjdk11 ptscotch-mpich ptscotch-mpich-devel ptscotch-mpich-devel-parmetis ptscotch-openmpi ptscotch-openmpi-devel purple-sipe pygobject2-doc pygtk2 pygtk2-codegen pygtk2-devel pygtk2-doc python-nose-docs python-nss-doc python-podman-api python-psycopg2-doc python-pymongo-doc python-redis python-schedutils python-slip python-sqlalchemy-doc python-varlink python-virtualenv-doc python2-backports python2-backports-ssl_match_hostname python2-bson python2-coverage python2-docs python2-docs-info python2-funcsigs python2-ipaddress python2-mock python2-nose python2-numpy-doc python2-psycopg2-debug python2-psycopg2-tests python2-pymongo python2-pymongo-gridfs python2-pytest-mock python2-sqlalchemy python2-tools python2-virtualenv python3-bson python3-click python3-coverage python3-cpio python3-custodia python3-docs python3-flask python3-gevent python3-gobject-base python3-hivex python3-html5lib python3-hypothesis python3-ipatests python3-itsdangerous python3-jwt python3-libguestfs python3-mock python3-networkx-core python3-nose python3-nss python3-openipmi python3-pillow python3-ptyprocess python3-pydbus python3-pymongo python3-pymongo-gridfs python3-pyOpenSSL python3-pytoml python3-reportlab python3-schedutils python3-scons python3-semantic_version python3-slip python3-slip-dbus python3-sqlalchemy python3-syspurpose python3-virtualenv python3-webencodings python3-werkzeug python38-asn1crypto python38-numpy-doc python38-psycopg2-doc python38-psycopg2-tests python39-numpy-doc python39-psycopg2-doc python39-psycopg2-tests qemu-kvm-block-gluster qemu-kvm-block-iscsi qemu-kvm-block-ssh qemu-kvm-hw-usbredir qemu-kvm-tests qpdf-doc qpid-proton qrencode qrencode-devel qrencode-libs qt5-qtcanvas3d qt5-qtcanvas3d-examples rarian rarian-compat recode redhat-menus redhat-support-lib-python redhat-support-tool reflections regexp relaxngDatatype rhsm-gtk rpm-plugin-prioreset rpmemd rsyslog-udpspoof ruby-hivex ruby-libguestfs rubygem-abrt rubygem-abrt-doc rubygem-bson rubygem-bson-doc rubygem-mongo rubygem-mongo-doc s390utils-cmsfs samba-pidl samba-test samba-test-libs samyak-devanagari-fonts samyak-fonts-common samyak-gujarati-fonts samyak-malayalam-fonts samyak-odia-fonts samyak-tamil-fonts sane-frontends sanlk-reset scala scotch scotch-devel SDL_sound selinux-policy-minimum sendmail sgabios sgabios-bin shrinkwrap sisu-inject sisu-mojos sisu-plexus skkdic smc-anjalioldlipi-fonts smc-dyuthi-fonts smc-fonts-common smc-kalyani-fonts smc-raghumalayalam-fonts smc-suruma-fonts softhsm-devel sonatype-oss-parent sonatype-plugins-parent sos-collector sparsehash-devel spec-version-maven-plugin spice spice-client-win-x64 spice-client-win-x86 spice-glib spice-glib-devel spice-gtk spice-gtk-tools spice-gtk3 spice-gtk3-devel spice-gtk3-vala spice-parent spice-protocol spice-qxl-wddm-dod spice-server spice-server-devel spice-qxl-xddm spice-server spice-streaming-agent spice-vdagent-win-x64 spice-vdagent-win-x86 sssd-libwbclient stax-ex stax2-api stringtemplate stringtemplate4 subscription-manager-initial-setup-addon subscription-manager-migration subscription-manager-migration-data subversion-javahl SuperLU SuperLU-devel supermin-devel swig-doc swig-gdb swtpm-devel swtpm-tools-pkcs11 system-storage-manager tcl-brlapi testng tibetan-machine-uni-fonts timedatex tpm-quote-tools tpm-tools tpm-tools-pkcs11 treelayout trousers trousers-lib tuned-profiles-compat tuned-profiles-nfv-host-bin tuned-utils-systemtap tycho uglify-js unbound-devel univocity-output-tester univocity-parsers usbguard-notifier usbredir-devel utf8cpp uthash velocity vinagre virt-dib virt-p2v-maker vm-dump-metrics-devel weld-parent wodim woodstox-core wqy-microhei-fonts wqy-unibit-fonts xdelta xmlgraphics-commons xmlstreambuffer xinetd xorg-x11-apps xorg-x11-drv-qxl xorg-x11-server-Xspice xsane-gimp xz-java xz-java-javadoc yajl-devel yp-tools ypbind ypserv 9.19. Deprecated and unmaintained devices
This section lists devices (drivers, adapters) that
continue to be supported until the end of life of RHEL 8 but will likely not be supported in future major releases of this product and are not recommended for new deployments. Support for devices other than those listed remains unchanged. These are
deprecated
devices.
are available but are no longer being tested or updated on a routine basis in RHEL 8. Red Hat may fix serious bugs, including security bugs, at its discretion. These devices should no longer be used in production, and it is likely they will be disabled in the next major release. These are
unmaintained
devices.
PCI device IDs are in the format of
vendor:device:subvendor:subdevice
. If no device ID is listed, all devices associated with the corresponding driver have been deprecated. To check the PCI IDs of the hardware on your system, run the
Table 9.1. Deprecated devices
Table 9.2. Unmaintained devices
Chapter 10. Known issuesThis part describes known issues in Red Hat Enterprise Linux 8.6. 10.1. Installer and image creationInstallation fails on IBM Power 10 systems with LPAR and secure boot enabled
RHEL installer is not integrated with static key secure boot on IBM Power 10 systems. Consequently, when logical partition (LPAR) is enabled with the secure boot option, the installation fails with the error,
Unexpected SELinux policies on systems where Anaconda is running as an application
When Anaconda is running as an application on an already installed system (for example to perform another installation to an image file using the
The
The
The
Performing a RHEL installation with the
The USB CD-ROM drive is not available as an installation source in Anaconda
Installation fails when the USB CD-ROM drive is the source for it and the Kickstart
Network access is not enabled by default in the installation program
Several installation features require network access, for example, registration of a system using the Content Delivery Network (CDN), NTP server support, and network installation sources. However, network access is not enabled by default, and as a result, these features cannot be used until network access is enabled.
To work around this problem, add
Hard drive partitioned installations with iso9660 filesystem fails
You cannot install RHEL on systems where the hard drive is partitioned with the
IBM Power systems with
IBM Power Systems with
10.2. Subscription management
In Red Hat Enterprise Linux 8, four attributes of the
10.3. Software management
The
YUM transactions reported as successful when a scriptlet fails Since RPM version 4.6, post-install scriptlets are allowed to fail without being fatal to the transaction. This behavior propagates up to YUM as well. This results in scriptlets which might occasionally fail while the overall package transaction reports as successful. There is no workaround available at the moment. Note that this is expected behavior that remains consistent between RPM and YUM. Any issues in scriptlets should be addressed at the package level. ( BZ#1986657 ) A security DNF upgrade can skip obsoleted packages
The patch for
BZ#2095764
, released with the
RHBA-2022:5816
advisory, introduced the following regression: The DNF upgrade using security filters, such as the
10.4. Shells and command-line tools
GNU Core Utilities (
10.5. Infrastructure servicesPostfix TLS fingerprint algorithm in the FIPS mode needs to be changed to SHA-256
By default in RHEL 8,
The
It is not possible to have both 32-bit and 64-bit versions of the
10.6. Security
File permissions of
Because of an issue with the CIS Benchmark, the remediation of the SCAP rule that ensures permissions on the
The
# yum module enable libselinux-python # yum install libselinux-python
Alternatively, install
# yum module install libselinux-python:2.8/common
As a result, you can install
The Red Hat Universal Base Image 8 (UBI 8) containers set the
Disabling SELinux using the
The output of the
OpenSSL in FIPS mode accepts only specific D-H parameters
In FIPS mode, TLS clients that use OpenSSL return a
The RHEL 8 system-wide cryptographic policies should disable Camellia ciphers in all policy levels, as stated in the product documentation. However, the Kerberos protocol enables the ciphers by default.
To work around the problem, apply the
# update-crypto-policies --set DEFAULT:NO-CAMELLIA
In the previous command, replace
Smart-card provisioning process through OpenSC
The
app pkcs15-init {
framework pkcs15 {
use_file_caching = false;
The smart-card provisioning through
10.7. Networking
The
Based on the information received from the cloud environment, the
# systemctl disable --now nm-cloud-setup.service nm-cloud-setup.timer Display the available connection profiles: # nmcli connection show Reactive the affected connection profiles: # nmcli connection up "<profile_name>" As a result, the service no longer removes manually-configured secondary IP addresses from interfaces. ( BZ#2132754 ) The primary IP address of an instance changes after starting the nm-cloud-setup service in Alibaba Cloud
After launching an instance in the Alibaba Cloud, the
NetworkManager does not support activating bond and team ports in a specific order NetworkManager activates interfaces alphabetically by interface names. However, if an interface appears later during the boot, for example, because the kernel needs more time to discover it, NetworkManager activates this interface later. NetworkManager does not support setting a priority on bond and team ports. Consequently, the order in which NetworkManager activates ports of these devices is not always predictable. To work around this problem, write a dispatcher script. For an example of such a script, see the corresponding comment in the ticket. ( BZ#1920398 )
Systems with the
Systems with the
IPv6_rpfilter=no As a result, the system performs better, but also has reduced security. ( BZ#1871860 ) RoCE interfaces lose their IP settings due to an unexpected change of the network interface name
The RDMA over Converged Ethernet (RoCE) interfaces lose their IP settings due to an unexpected change of the network interface name if both conditions are met:
User upgrades from a RHEL 8.6 system or earlier.
The RoCE card is enumerated by UID.
To workaround this problem:
Create the
[Match] Architecture=s390x KernelCommandLine=!net.naming-scheme=rhel-8.7 [Link] NamePolicy=kernel database slot path AlternativeNamesPolicy=database slot path MACAddressPolicy=persistent
10.8. Kernel
Using
In
cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation (BZ#2046396) Anaconda in some cases fails after entering the passphrase for encrypted devices
If
Reloading an identical crash extension may cause segmentation faults When you load a copy of an already loaded crash extension file, it might trigger a segmentation fault. Currently, the crash utility detects if an original file has been loaded. Consequently, due to two identical files co-existing in the crash utility, a namespace collision occurs, which triggers the crash utility to cause a segmentation fault. You can work around the problem by loading the crash extension file only once. As a result, segmentation faults no longer occur in the described scenario. ( BZ#1906482 ) vmcore capture fails after memory hot-plug or unplug operation
After performing the memory hot-plug or hot-unplug operation, the event comes after updating the device tree which contains memory layout information. Thereby the
# systemctl restart kdump.service
As a result,
Debug kernel fails to boot in crash capture environment on RHEL 8 Due to the memory-intensive nature of the debug kernel, a problem occurs when the debug kernel is in use and a kernel panic is triggered. As a consequence, the debug kernel is not able to boot as the capture kernel and a stack trace is generated instead. To work around this problem, increase the crash kernel memory as required. As a result, the debug kernel boots successfully in the crash capture environment. (BZ#1659609) Allocating crash kernel memory fails at boot time
On some Ampere Altra systems, allocating the crash kernel memory during boot fails when the 32-bit region is disabled in BIOS settings. Consequently, the
The kernel ACPI driver reports it has no access to a PCIe ECAM memory region The Advanced Configuration and Power Interface (ACPI) table provided by firmware does not define a memory region on the PCI bus in the Current Resource Settings (_CRS) method for the PCI bus device. Consequently, the following warning message occurs during the system boot: [ 2.817152] acpi PNP0A08:00: [Firmware Bug]: ECAM area [mem 0x30000000-0x31ffffff] not reserved in ACPI namespace [ 2.827911] acpi PNP0A08:00: ECAM at [mem 0x30000000-0x31ffffff] for [bus 00-1f]
However, the kernel is still able to access the
03:00.0 Non-Volatile memory controller: Sandisk Corp WD Black 2018/PC SN720 NVMe SSD (prog-if 02 [NVM Express])
Capabilities: [900 v1] L1 PM Substates
L1SubCap: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2+ ASPM_L1.1- L1_PM_Substates+
PortCommonModeRestoreTime=255us PortTPowerOnTime=10us
L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2- ASPM_L1.1-
T_CommonMode=0us LTR1.2_Threshold=0ns
L1SubCtl2: T_PwrOn=10us
As a result, you can ignore the warning message.
For more information about the problem, see the
"Firmware Bug: ECAM area
The
Executing the
The HP NMI watchdog does not always generate a crash dump
In certain cases, the
Using
Due to an existing problem with the
# KDUMP_COMMANDLINE_REMOVE="hugepages hugepagesz slub_debug quiet log_buf_len swiotlb"
Remove
# KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 reset_devices cgroup_disable=memory udev.children-max=2 panic=10 swiotlb=noforce novmcoredd"
Restart the
# systemctl restart kdump
As a result, the first kernel boots correctly and the
Connections fail when attaching a virtual function to virtual machine
Pensando network cards that use the
The OPEN MPI library may trigger run-time failures with default PML
In OPEN Message Passing Interface (OPEN MPI) implementation 4.0.x series, Unified Communication X (UCX) is the default point-to-point communicator (PML). The later versions of OPEN MPI 4.0.x series deprecated
-mca btl openib -mca pml ucx -x UCX_NET_DEVICES=mlx5_ib0
where,
The
-mca pml_ucx_priority 5 As a result, the OPEN MPI library is able to choose an alternative available transport layer over UCX. (BZ#1866402) The Solarflare fails to create maximum number of virtual functions (VFs)
The Solarflare NICs fail to create a maximum number of VFs due to insufficient resources. You can check the maximum number of VFs that a PCIe device can create in the
# sfboot vf-msix-limit=2
Note
Adjusting VF MSI interrupt value affects the VF performance.
For more information about parameters to be adjusted accordingly, see the
Memory allocation for
On certain 64-bit ARM based systems, the firmware uses the non-contiguous memory allocation method, which reserves memory randomly at different scattered locations. Consequently, due to the unavailability of consecutive blocks of memory, the crash kernel cannot reserve memory space for the
10.9. File systems and storage
Limitations of LVM
The
XFS quota warnings are triggered too often Using the quota timer results in quota warnings triggering too often, which causes soft quotas to be enforced faster than they should. To work around this problem, do not use soft quotas, which will prevent triggering warnings. As a result, the amount of warning messages will not enforce soft quota limit anymore, respecting the configured timeout. (BZ#2059262)
LVM
Mirrored LVM devices with a segment type of
The
You cannot place the
LVM no longer allows creating volume groups with mixed block sizes
LVM utilities such as
Using Device mapper multipath with the NVMe/TCP driver causes system instability
DM multipath is not supported with the NVMe/TCP driver. Using it causes sleeping functions in the kernel to be called in an atomic context, which then results in system instability.
To workaround the problem, enable native NVMe multipath. Do not use DM multipath tools. For RHEL 8, add the option
The
In
# systemctl enable --now blk-availability.service As a result, complex virtual device stacks are correctly deactivated during shutdown and do not produce error messages. (BZ#2011699) 10.10. Dynamic programming languages, web and database servers
When a user of NIS uses a 32-bit application that calls the
When the
PAM plug-in version 1.0 does not work in
Symbol conflicts between OpenLDAP libraries might cause crashes in
When both the
10.11. Identity ManagementWindows Server 2008 R2 and earlier no longer supported In RHEL 8.4 and later, Identity Management (IdM) does not support establishing trust to Active Directory with Active Directory domain controllers running Windows Server 2008 R2 or earlier versions. RHEL IdM now requires SMB encryption when establishing the trust relationship, which is only available with Windows Server 2012 or later. ( BZ#1971061 )
Using the
Using the
The
During the IdM installation, a range of 200,000 UIDs from a total of 10,000 possible ranges is randomly selected and assigned. Selecting a random range in this way significantly reduces the probability of conflicting IDs in case you decide to merge two separate IdM domains in the future.
However, having high UIDs can create problems with the
FIPS mode does not support using a shared secret to establish a cross-forest trust Establishing a cross-forest trust using a shared secret fails in FIPS mode because NTLMSSP authentication is not FIPS-compliant. To work around this problem, authenticate with an Active Directory (AD) administrative account when establishing a trust between an IdM domain with FIPS mode enabled and an AD domain. ( BZ#1924707 ) FreeRADIUS server fails to run in FIPS mode By default, in FIPS mode, OpenSSL disables the use of the MD5 digest algorithm. As the RADIUS protocol requires MD5 to encrypt a secret between the RADIUS client and the RADIUS server, this causes the FreeRADIUS server to fail in FIPS mode. To work around this problem, follow these steps: Procedure
Note that though FreeRADIUS can run in FIPS mode, this does not mean that it is FIPS compliant as it uses weak ciphers and functions when in FIPS mode. For more information on configuring FreeRADIUS authentication in FIPS mode, see How to configure FreeRADIUS authentication in FIPS mode . ( BZ#1958979 ) Actions required when running Samba as a print server and updating from RHEL 8.4 and earlier
With this update, the
# systemctl restart smbd
If you newly installed Samba on RHEL 8.5 or later, no action is required. The default
Downgrading
The
# authselect select sssd --force ( BZ#1892761 )
The
In Directory Server you can use the
Security Initialization - SSL alert: Failed to set SSL cipher preference information: invalid ciphers <default,+__cipher_name__>: format is +cipher1,-cipher2... (Netscape Portable Runtime error 0 - no error) As a workaround, specify all ciphers that are enabled by default in NSS including the ones you want to additionally enable. ( BZ#1817505 )
Potential risk when using the default value for
When using
10.12. Desktop
Disabling
Currently, it is not possible to disable or remove
Generation 2 RHEL 8 virtual machines sometimes fail to boot on Hyper-V Server 2016 hosts When using RHEL 8 as the guest operating system on a virtual machine (VM) running on a Microsoft Hyper-V Server 2016 host, the VM in some cases fails to boot and returns to the GRUB boot menu. In addition, the following error is logged in the Hyper-V event log: The guest operating system reported that it failed with the following error code: 0x1E This error occurs due to a UEFI firmware bug on the Hyper-V host. To work around this problem, use Hyper-V Server 2019 or later as the host. (BZ#1583445) Drag-and-drop does not work between desktop and applications
Due to a bug in the
10.13. Graphics infrastructures
The
dracut_args --omit-drivers "radeon" force_rebuild 1
Restart the machine and
kdump
. After starting
kdump
, the
Multiple HDR displays on a single MST topology may not power on
On systems using NVIDIA Turing GPUs with the
GUI in ESXi might crash due to low video memory The graphical user interface (GUI) on RHEL virtual machines (VMs) in the VMware ESXi 7.0.1 hypervisor with vCenter Server 7.0.1 requires a certain amount of video memory. If you connect multiple consoles or high-resolution monitors to the VM, the GUI requires at least 16 MB of video memory. If you start the GUI with less video memory, the GUI might terminate unexpectedly. To work around the problem, configure the hypervisor to assign at least 16 MB of video memory to the VM. As a result, the GUI on the VM no longer crashes. If you encounter this issue, Red Hat recommends that you report it to VMware. See also the following VMware article: VMs with high resolution VM console may experience a crash on ESXi 7.0.1 (83194) . (BZ#1910358) VNC Viewer displays wrong colors with the 16-bit color depth on IBM Z
The VNC Viewer application displays wrong colors when you connect to a VNC session on an IBM Z server with the 16-bit color depth.
To work around the problem, set the 24-bit color depth on the VNC server. With the
Unable to run graphical applications using
When trying to run graphical applications as a user with elevated privileges, the application fails to open with an error message. The failure happens because
Hardware acceleration is not supported on ARM Built-in graphics drivers do not support hardware acceleration or the Vulkan API on the 64-bit ARM architecture. To enable hardware acceleration or Vulkan on ARM, install the proprietary Nvidia driver. (JIRA:RHELPLAN-57914) 10.14. The web consoleRemoving USB host devices using the web console does not work as expected
When you attach a USB device to a virtual machine (VM), the device number and bus number of the USB device might change after they are passed to the VM. As a consequence, using the web console to remove such devices fails due to the incorrect correlation of the device and bus numbers. To workaround this problem, remove the
Attaching multiple host devices using the web console does not work When you select multiple devices to attach to a virtual machine (VM) using the web console, only a single device is attached and the rest are ignored. To work around this problem, attach only one device at a time. (JIRA:RHELPLAN-115603) 10.15. Red Hat Enterprise Linux System Roles
Unable to manage
With the inclusion of the
10.16. VirtualizationNetwork traffic performance in virtual machines might be reduced In some cases, RHEL 8.6 guest virtual machines (VMs) have somewhat decreased performance when handling high levels of network traffic. (BZ#2069047) Using a large number of queues might cause Windows virtual machines to fail Windows virtual machines (VMs) might fail when the virtual Trusted Platform Module (vTPM) device is enabled and the multi-queue virtio-net feature is configured to use more than 250 queues. This problem is caused by a limitation in the vTPM device. The vTPM device has a hardcoded limit on the maximum number of opened file descriptors. Since multiple file descriptors are opened for every new queue, the internal vTPM limit can be exceeded, causing the VM to fail. To work around this problem, choose one of the following two options: Keep the vTPM device enabled, but use less than 250 queues. Disable the vTPM device to use more than 250 queues. ( BZ#2020133 ) Live post-copy migration of VMs with failover VFs does not work Currently, attempting to post-copy migrate a running virtual machine (VM) fails if the VM uses a device with the virtual function (VF) failover capability enabled. To work around the problem, use the standard migration type, rather than post-copy migration. (BZ#2054656) Live migrating VMs to a RHEL 8.6 Intel host from an earlier minor version of RHEL 8 does not work
Because the Intel Transactional Synchronization Extensions (TSX) feature has become deprecated, RHEL 8.6 hosts on Intel hardware no longer use the
The
On certain AMD Milan systems, the Enhanced REP MOVSB (
Attaching LUN devices to virtual machines using virtio-blk does not work
The q35 machine type does not support transitional virtio 1.0 devices, and RHEL 8 therefore lacks support for features that were deprecated in virtio 1.0. In particular, it is not possible on a RHEL 8 host to send SCSI commands from virtio-blk devices. As a consequence, attaching a physical disk as a LUN device to a virtual machine fails when using the virtio-blk controller.
Note that physical disks can still be passed through to the guest operating system, but they should be configured with the
Virtual machines with
RHEL 8 currently does not support the
IBM POWER hosts may crash when using the
When running RHEL 8 on a PowerVM logical partition (LPAR), a variety of errors may currently occur due to problems with the
Using
When using a RHEL 8 host on the little-endian variant of IBM POWER hardware, using the
# perf kvm record -e trace_imc/trace_cycles/ -p <guest pid> -i
Note that when using the
Windows Server 2016 virtual machines with Hyper-V enabled fail to boot when using certain CPU models Currently, it is not possible to boot a virtual machine (VM) that uses Windows Server 2016 as the guest operating system, has the Hyper-V role enabled, and uses one of the following CPU models: EPYC-IBPB To work around this problem, use the EPYC-v3 CPU model, or manually enable the xsaves CPU flag for the VM. (BZ#1942888) Migrating a POWER9 guest from a RHEL 7-ALT host to RHEL 8 fails
Currently, migrating a POWER9 virtual machine from a RHEL 7-ALT host system to RHEL 8 becomes unresponsive with a
Using
After modifying a virtual machine (VM) disk image using the
Deleting a forward interface from a macvtap virtual network resets all connection counts of this network
Currently, deleting a forward interface from a
Virtual machines with SLOF fail to boot in netcat interfaces
When using a netcat (
Attaching mediated devices to virtual machines in
The
RHEL 9 virtual machines fail to boot in POWER8 compatibility mode Currently, booting a virtual machine (VM) that runs RHEL 9 as its guest operating system fails if the VM also uses CPU configuration similar to the following: <cpu mode="host-model">
<model>power8</model>
To work around this problem, do not use POWER8 compatibility mode in RHEL 9 VMs.
In addition, note that running RHEL 9 VMs is not possible on POWER8 hosts.
(BZ#2035158)
10.17. RHEL in cloud environmentsSR-IOV performs suboptimally in ARM 64 RHEL 8 virtual machines on Azure Currently, SR-IOV networking devices have significantly lower throughout and higher latency than expected in ARM 64 RHEL 8 virtual machines (VMs) running on a Microsoft Azure platform. (BZ#2068429) Setting static IP in a RHEL 8 virtual machine on a VMware host does not work
Currently, when using RHEL 8 as a guest operating system of a virtual machine (VM) on a VMware host, the DatasourceOVF function does not work correctly. As a consequence, if you use the
kdump sometimes does not start on Azure and Hyper-V
On RHEL 8 guest operating systems hosted on the Microsoft Azure or Hyper-V hypervisors, starting the
# echo N > /sys/module/kernel/parameters/crash_kexec_post_notifiers (BZ#1865745) The SCSI host address sometimes changes when booting a Hyper-V VM with multiple guest disks Currently, when booting a RHEL 8 virtual machine (VM) on the Hyper-V hypervisor, the host portion of the Host, Bus, Target, Lun (HBTL) SCSI address in some cases changes. As a consequence, automated tasks set up with the HBTL SCSI identification or device node in the VM do not work consistently. This occurs if the VM has more than one disk or if the disks have different sizes. To work around the problem, modify your kickstart files, using one of the following methods: Method 1: Use persistent identifiers for SCSI devices. You can use for example the following powershell script to determine the specific device identifiers: # Output what the /dev/disk/by-id/<value> for the specified hyper-v virtual disk.
# Takes a single parameter which is the virtual disk file.
# Note: kickstart syntax works with and without the /dev/ prefix.
param (
[Parameter(Mandatory=$true)][string]$virtualdisk
$what = Get-VHD -Path $virtualdisk
$part = $what.DiskIdentifier.ToLower().split('-')
$p = $part[0]
$s0 = $p[6] + $p[7] + $p[4] + $p[5] + $p[2] + $p[3] + $p[0] + $p[1]
$p = $part[1]
$s1 = $p[2] + $p[3] + $p[0] + $p[1]
[string]::format("/dev/disk/by-id/wwn-0x60022480{0}{1}{2}", $s0, $s1, $part[4])
You can use this script on the hyper-v host, for example as follows: PS C:\Users\Public\Documents\Hyper-V\Virtual hard disks> .\by-id.ps1 .\Testing_8\disk_3_8.vhdx /dev/disk/by-id/wwn-0x60022480e00bc367d7fd902e8bf0d3b4 PS C:\Users\Public\Documents\Hyper-V\Virtual hard disks> .\by-id.ps1 .\Testing_8\disk_3_9.vhdx /dev/disk/by-id/wwn-0x600224807270e09717645b1890f8a9a2 Afterwards, the disk values can be used in the kickstart file, for example as follows: part / --fstype=xfs --grow --asprimary --size=8192 --ondisk=/dev/disk/by-id/wwn-0x600224807270e09717645b1890f8a9a2 part /home --fstype="xfs" --grow --ondisk=/dev/disk/by-id/wwn-0x60022480e00bc367d7fd902e8bf0d3b4
As these values are specific for each virtual disk, the configuration needs to be done for each VM instance. It may, therefore, be useful to use the
Starting a RHEL 8 virtual machine on AWS using
Currently, initializing an EC2 instance of RHEL 8 using the
10.18. Supportability
The
The
Because a cryptographic key used by a certificate on the Customer Portal API does not meet the requirements by the
Timeout when running
When running the
# sos report -k processor.timeout=1800
[plugin_options] # Specify any plugin options and their values here. These options take the form # plugin_name.option_name = value #rpm.rpmva = off processor.timeout = 1800 The example value is set to 1800. The particular timeout value highly depends on a specific system. To set the plugin’s timeout appropriately, you can first estimate the time needed to collect the one plugin with no timeout by running the following command: # time sos report -o processor -k processor.timeout=0 --batch --build (BZ#2011413) 10.19. ContainersRunning systemd within an older container image does not work
Running systemd within an older container image, for example,
$ podman run --rm -ti centos:7 /usr/lib/systemd/systemd Storing signatures Failed to mount cgroup at /sys/fs/cgroup/systemd: Operation not permitted [!!!!!!] Failed to mount API filesystems, freezing. To work around this problem, use the following commands: # mkdir /sys/fs/cgroup/systemd # mount none -t cgroup -o none,name=systemd /sys/fs/cgroup/systemd # podman run --runtime /usr/bin/crun --annotation=run.oci.systemd.force_cgroup_v1=/sys/fs/cgroup --rm -ti centos:7 /usr/lib/systemd/systemd (JIRA:RHELPLAN-96940) Container images signed with a Beta GPG key can not be pulled
Currently, when you try to pull RHEL Beta container images,
sudo wget -O /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta https://www.redhat.com/security/data/f21541eb.txt To add the Beta GPG key as trusted to your namespace, use one of the following commands: $ sudo podman image trust set -f /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta registry.access.redhat.com/namespace
$ sudo podman image trust set -f /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta registry.redhat.io/namespace
Replace namespace with ubi9-beta or rhel9-beta . ( BZ#2020301 ) Chapter 11. Internationalization11.1. Red Hat Enterprise Linux 8 international languagesRed Hat Enterprise Linux 8 supports the installation of multiple languages and the changing of languages based on your requirements. East Asian Languages - Japanese, Korean, Simplified Chinese, and Traditional Chinese. European Languages - English, German, Spanish, French, Italian, Portuguese, and Russian. The following table lists the fonts and input methods provided for various major languages.
11.2. Notable changes to internationalization in RHEL 8
RHEL 8 introduces the following changes to internationalization compared to RHEL 7:
Support for the
Unicode 11
computing industry standard has been added.
Internationalization is distributed in multiple packages, which allows for smaller footprint installations. For more information, see
Using langpacks
.
A number of
Appendix A. List of tickets by componentBugzilla and JIRA IDs are listed in this document for reference. Bugzilla bugs that are publicly accessible include a link to the ticket.
Appendix B. Revision history
0.1-7
Wed May 10 2023, Jaroslav Klech ( [email protected] ) Added a known issue BZ#2169382 (Networking).
0.1-6
Thu Apr 27 2023, Gabriela Fialová ( [email protected] ) Added a known issue JIRA:RHELPLAN-155168 (Identity Management).
0.1-5
Thu Apr 13 2023, Gabriela Fialová ( [email protected] ) Fixed 2 broken links in DFs and KIs.
0.1-4
Thu Mar 2 2023, Lucie Vařáková ( [email protected] ) Updated a new feature BZ#2089409 (Kernel).
0.1-4
Tue Jan 24 2023, Lucie Vařáková ( [email protected] ) Added a known issue BZ#2115791 (RHEL in cloud environments).
0.1-3
Thu Dec 08 2022, Marc Muehlfeld ( [email protected] ) Added a known issue BZ#2132754 (Networking).
0.1-2
Tue Nov 08 2022, Lucie Vařáková ( [email protected] ) Added new features JIRA:RHELPLAN-137623 and BZ#2130912 (Containers). Added a Technology Preview JIRA:RHELPLAN-137622 (Containers). Added a known issue BZ#2134184 (Virtualization).
0.1-1
Wed Sep 07 2022, Lucie Vařáková ( [email protected] ) Added bug fix BZ#2096256 (Networking). Other minor updates.
0.1-0
Fri Aug 19 2022, Lucie Vařáková ( [email protected] ) Added bug fix BZ#2108316 (Identity Management).
0.0-9
Fri Aug 05 2022, Lucie Vařáková ( [email protected] ) Added known issue BZ#2114981 (Security).
0.0-8
Wed Aug 03 2022, Lenka Špačková ( [email protected] ) Added known issue BZ#2095764 (Software management).
0.0-7
Fri Jul 22 2022, Lucie Vařáková ( [email protected] ) Added bug fix BZ#2020494 (File systems and storage). Added known issue BZ#2054656 (Virtualization). Other minor updates.
0.0-6
Mon Jul 11 2022, Lenka Špačková ( [email protected] ) Added bug fix BZ#2056451 (Installer and image creation). Added bug fix BZ#2051890 (Security). Other minor updates.
0.0-5
Jun 08 2022, Lucie Vařáková ( [email protected] ) Added new feature BZ#2089409 (Kernel).
0.0-4
May 31 2022, Lucie Vařáková ( [email protected] ) Added known issues BZ#2075508 (Security) and BZ#2077770 (Virtualization). Added Technology Previews BZ#1989930 (RHEL for Edge) and JIRA:RHELPLAN-108438 (The web console). Added information about the in-place upgrade from RHEL 8 to RHEL 9 to the In-place upgrade and OS conversion section. Other minor updates.
0.0-3
May 18 2022, Lucie Maňásková ( [email protected] ) Added new feature BZ#2049441 (The web console). Added known issues BZ#2086100 (Kernel) and BZ#2020133 (Virtualization). Other small updates.
0.0-2
May 16 2022, Lucie Maňásková ( [email protected] ) Added bug fix BZ#2014369 (Virtualization). Added known issue BZ#1554735 (Virtualization). Other small updates.
0.0-1
May 11 2022, Lucie Maňásková ( [email protected] ) Release of the Red Hat Enterprise Linux 8.6 Release Notes.
0.0-0
Mar 30 2022, Lucie Maňásková ( [email protected] ) Release of the Red Hat Enterprise Linux 8.6 Beta Release Notes. Legal Notice
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at
http://creativecommons.org/licenses/by-sa/3.0/
. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, the Red Hat logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux
® is the registered trademark of Linus Torvalds in the United States and other countries.
Java
® is a registered trademark of Oracle and/or its affiliates.
XFS
® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.
MySQL
® is a registered trademark of MySQL AB in the United States, the European Union and other countries.
Node.js
® is an official trademark of Joyent. Red Hat is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.
The
OpenStack
® Word Mark and OpenStack logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.
All other trademarks are the property of their respective owners.
|
推荐文章
|
|
销魂的自行车 · ToggleButton 8 月前 |