Chapter 4. New features

Anaconda supports rhsm for machine provisioning through Kickstart installations for Satellite

Previously, machine provisioning depended on a custom %post script for Kickstart installation on Red Hat Satellite. This %post script imported the custom Satellite self-signed certificate, registered the machine, attached a subscription, and installed packages residing in repositories.

RHEL supports localhost as a static hostname

Starting with RHEL 9, setting localhost as a static hostname in /etc/hostname is valid. In this case, NetworkManager does not try to obtain a transient hostname through DHCP or reverse DNS lookup.

Licensing, system, and user setting configuration screens have been disabled post standard installation

Previously, RHEL users were configuring Licensing, System (Subscription manager), and User Settings prior to the gnome-initial-setup and login screens. With this update, the initial setup screens have been disabled by default to improve user experience.

Anaconda activates network automatically for interactive installations

Previously, when performing an interactive installation without having the network activated by Kickstart or boot options, users had to activate the network manually in the network spoke. With this update, Anaconda activates the network automatically, without requiring users to visit the network spoke and activate it manually.

Image Builder now supports filesystem configuration

With this enhancement, you can specify custom filesystem configuration in your blueprints and you can create images with the desired disk layout. As a result, by having non-default layouts, you can benefit from security benchmarks, consistency with existing setups, performance, and protection against out-of-disk errors.

New options to Lock root account and Allow root SSH login with password

The following new options have been added on the root password configuration screen in the RHEL graphical installation:

Image Builder now supports creating bootable installer images

With this enhancement, you can use Image Builder to create bootable ISO images that consist of a tarball file, which contains a root file system. As a result, you can use the bootable ISO image to install the tarball file system to a bare metal system.

RHEL for Edge now supports Greenboot built-in health checks by default

With this update, RHEL for Edge Greenboot now includes built-in health checks with watchdog feature to ensure that the hardware does not hang or freeze while rebooting. With that, you can benefit from the following features:

RHEL 9 provides rpm-ostree v2022.2

RHEL 9 is distributed with the rpm-ostree version v2022.2, which provides multiple bug fixes and enhancements. Notable changes include:

RHEL 9 provides OSTree v2021.2

RHEL 9 is distributed with the OSTree package version v2021.2, which provides multiple bug fixes and enhancements. Notable changes include:

The rpm-ostree rebase tool supports upgrade from RHEL 8 to RHEL 9

With this enhancement, you can upgrade your RHEL 8 system to RHEL 9 using the rpm-ostree rebase tool. It fully supports the default package set of RHEL for Edge upgrades between the most recent updates of RHEL 8 to the most recent updates of RHEL 9.

Merged system purpose commands under subscription-manager syspurpose

Previously, there were two different commands to set system purpose attributes; syspurpose and subscription-manager. To unify all the system purpose attributes under one module, all the addons, role, service-level, and usage commands from subscription-manager have been moved to the new submodule, subscription-manager syspurpose.

RHEL 9 provides RPM 4.16

RHEL 9 is distributed with RPM version 4.16. Notable bug fixes and enhancements over version 4.14 include:

New RPM plugin notifies fapolicyd about changes during RPM transactions

This update of the rpm packages introduces a new RPM plugin that integrates the fapolicyd framework with the RPM database. The plugin notifies fapolicyd about installed and changed files during an RPM transaction. As a result, fapolicyd now supports integrity checking.

RPM now supports the EdDSA public key algorithm

With this enhancement, the rpm command supports signing keys using the EdDSA public key algorithm. As a result, signing keys generated using EdDSA can now be used for signing and verifying packages.

RPM now supports the Zstandard (zstd) compression algorithm

With this enhancement, the default RPM compression algorithm has switched to Zstandard (zstd). As a result, users can benefit from faster package installations, which can be especially noticeable during large transactions.

New DNF options exclude_from_weak_autodetect and exclude_from_weak

With this enhancement, the default DNF behavior does not install unwanted weak dependencies. To modify this behavior, use the following new options:

RHEL 9 provides libmodulemd 2.13.0

RHEL 9 is distributed with the libmodulemd package version 2.13.0. Notable bug fixes and enhancements over version 2.9.4 include:

Bracketed paste is now enabled in bash by default

The bash readline library version 8.1 is now available, which enables bracketed paste mode by default. When you paste text to your terminal, bash highlights the text, and you must press enter to execute the pasted command. Bracketed paste mode is the default setting to avoid accidentally executing malicious commands.

RHEL 9 includes powerpc-utils 1.3.9

RHEL 9 provides the powerpc-utils package version 1.3.9. Notable bug fixes and enhancements over version 1.3.8 include:

RHEL 9 is distributed with opal-prd 6.7.1

The opal-prd package version 6.7.1 provides the following notable bug fixes and enhancements over the previously available version 6.6.3:

RHEL 9 provides lsvpd 1.7.12

RHEL 9 is distributed with the lsvpd package version 1.7.12. Notable bug fixes and enhancements over version 1.7.11 include:

ppc64-diag version 2.7.7 available

The ppc64-diag package version 2.7.7 is provided in RHEL 9. Notable bug fixes and enhancements over version 2.7.6 include:

RHEL 9 includes Fetchmail 6.4.24

RHEL 9 is distributed with the fetchmail package version 6.4.24. Fetchmail is a remote-mail retrieval and forwarding utility.

RHEL 9 includes Eigen 3.4

RHEL 9 is distributed with the eigen3 package version 3.4. Eigen 3.4 is a C++ template library for linear algebra, which now supports POWER10 matrix multiplication assist instructions.

RHEL 9 introduces the cdrskin package

RHEL 9 introduces the cdrskin package for burning data on CD, DVD, or BD media. The cdrskin package provides a replacement for the cdrecord executable from the wodim package, which is not available in RHEL 9.

The redhat.rhel_mgmt Ansible collection is supported in the RHEL 9 release

This update provides support to the Intelligent Platform Management Interface (IPMI) Ansible modules. IPMI is a specification for a set of management interfaces to communicate with baseboard management controller (BMC) devices. The IPMI modules - ipmi_power and ipmi_boot - are available in the redhat.rhel_mgmt Collection, which you can access by installing the ansible-collection-redhat-rhel_mgmt package.

RHEL 9 introduces the util-linux-core package

In addition to the util-linux package, RHEL 9 provides the util-linux-core subpackage for scenarios where the size of installed packages is a critical feature, for example buildroots, certain containers, and boot images.

Updated systemd-udevd assigns consistent network device names to InfiniBand interfaces

Introduced in RHEL 9, the new version of the systemd package contains the updated systemd-udevd device manager. The device manager changes the default names of InfiniBand interfaces to consistent names selected by systemd-udevd.

s-nail replaces mailx

The s-nail mail processing system has replaced the mailx utility. The s-nail utility is compatible with mailx and adds numerous new features. The mailx package is no longer maintained in the upstream.

TuneD 2.18 is available

RHEL 9 is distributed with TuneD version 2.18. Notable changes over version 2.16 include:

RHEL 9 provides mod_security_crs 3.3

RHEL 9 is distributed with the mod_security_crs package version 3.3. Notable bug fixes and enhancements include:

RHEL 9 provides chrony 4.1

RHEL 9 is distributed with chrony version 4.1. Notable bug fixes and enhancements over version 3.5 include:

System-wide crypto-policies are now more secure

With this update, the system-wide cryptographic policies have been adjusted to provide up-to-date secure defaults:

RHEL 9 provides OpenSSL 3.0.1

RHEL 9 provides openssl packages in upstream version 3.0.1, which includes many improvements and bug fixes over the previous version. The most notable changes include:

OpenSSL now includes providers

The OpenSSL toolkit in version 3.0.1, which is included in RHEL 9, added the concept of providers. Providers are collections of algorithms, and you can choose different providers for different applications. OpenSSL currently includes the following providers: base, default, fips, legacy, and null.

OpenSSL random bit generator now supports CPACF

This release of the openssl packages introduces support for the CP Assist for Cryptographic Functions (CPACF) in the OpenSSL NIST SP800-90A-compliant AES-based deterministic random bit generator (DRBG).

openssl-spkac can now create SPKAC files signed with SHA-1 and SHA-256

The openssl-spkac utility can now create Netscape signed public key and challenge (SPKAC) files signed with hashes different than MD5. You can now create and verify also SPKAC files signed with SHA-1 and SHA-256 hashes.

RHEL 9 provides openCryptoki 3.17.0

RHEL 9 is distributed with openCryptoki version 3.17.0. Notable bug fixes and enhancements over version 3.16.0 include:

GnuTLS provided in version 3.7.3

In RHEL 9, the gnutls packages are provided in upstream version 3.7.3. This provides many improvements and bug fixes over previous versions, most notably:

RHEL 9 provides NSS 3.71

RHEL 9 is distributed with the Network Security Services (NSS) libraries version 3.71. Notable changes include:

NSS no longer support RSA keys shorter than 1023 bits

The update of the Network Security Services (NSS) libraries changes the minimum key size for all RSA operations from 128 to 1023 bits. This means that NSS no longer perform the following functions:

Minimal RSA key bit length option in OpenSSH

Accidentally using short RSA keys might make the system more vulnerable to attacks. With this update, you can set RSA key minimal bit lengths for OpenSSH servers and clients. To define the minimal RSA key length, use the new RSAMinSize option in the /etc/ssh/sshd_config file for OpenSSH servers, and in the /etc/ssh/ssh_config file for OpenSSH clients.

OpenSSH distributed in 8.7p1

RHEL 9 includes OpenSSH in version 8.7p1. This version provides many enhancements and bug fixes over OpenSSH version 8.0p1, which is distributed in RHEL 8.5, most notably:

Locale forwarding disabled by default in OpenSSH

Using the C.UTF-8 locale in small images, such as containers and virtual machines, reduces size and improves performance over using the traditional en_US.UTF-8 locale.

OpenSSH supports U2F/FIDO security keys

Previously, the OpenSSH keys stored in hardware were only supported through the PKCS #11 standard, which limited the use of other security keys in SSH. Support for U2F/FIDO security keys was developed upstream and is now implemented in RHEL 9. This results in an improved usability of security keys within SSH independent of the PKCS #11 interface.

Libreswan provided in version 4.6

In RHEL 9, Libreswan is provided in upstream version 4.6. This version provides many bug fixes and enhancements, most notably improvements on labeled IPsec used with Internet Key Exchange version 2 (IKEv2).

Libreswan does not accept IKEv1 packages by default

Because the Internet Key Exchange v2 (IKEv2) protocol is now widely deployed, Libreswan no longer supports IKEv1 packets by default. IKEv2 provides a more secure environment and more resilience against attacks. If your scenario requires the use of IKEv1, you can enable it by adding the ikev1-policy=accept option to the /etc/ipsec.conf configuration file.

RHEL 9 provides stunnel 5.62

RHEL 9 is distributed with the stunnel package version 5.62. Notable bug fixes and enhancements include:

RHEL 9 provides nettle 3.7.3

RHEL 9 provides the nettle package 3.7.3 version with multiple bug fixes and enhancements. Notable changes are the following:

RHEL 9 provides p11-kit 0.24

RHEL 9 provides p11-kit package with 0.24 version. This version provides multiple bug fixes and enhancements. Notably, the subdirectory for storing distrusted Certificate Authorities has been renamed to blocklist.

cyrus-sasl now uses GDBM instead of Berkeley DB

The cyrus-sasl package is now built without the libdb dependency, and the sasldb plugin uses the GDBM database format instead of Berkeley DB. To migrate your existing Simple Authentication and Security Layer (SASL) databases stored in the old Berkeley DB format, use the cyrusbdb2current tool with the following syntax:

SELinux policy in RHEL 9 is up-to-date with the current kernel

The SELinux policy includes new permissions, classes, and capabilities that are also part of the kernel. Therefore, SELinux can utilize the full potential provided by the kernel. Specifically, SELinux has better granularity for granting permissions, which has subsequent security benefits. This also enables running systems with the MLS SELinux policy because the MLS policy would prevent some systems from starting if the system contained permissions unknown to the policy.

Default SELinux policy disallows commands with text relocation libraries

The selinuxuser_execmod boolean is now off by default to improve the security footprint of installed systems. As a result, SELinux users cannot enter commands using libraries that require text relocation, unless the library files have the textrel_shlib_t label.

OpenSCAP is provided in version 1.3.6

RHEL 9 includes OpenSCAP in version 1.3.6, which provides bug fixes and improvements, most notably:

OSCAP Anaconda Add-on now supports a new add-on name

With this enhancement, you can use the new com_redhat_oscap add-on name as opposed to the legacy org_fedora_oscap add-on name in the Kickstart file for the OSCAP Anaconda Add-on plugin. For example, the Kickstart section can be structured as follows:

CVE OVAL feeds now compressed

With this update, Red Hat provides CVE OVAL feeds in a compressed form. They are no longer available as XML files, but are in the bzip2 format instead. The location of the feeds for RHEL9 has also been updated to reflect this change. Note that third-party SCAP scanners might have problems with scanning rules that use a compressed feed because referencing compressed content is not standardized.

SCAP Security Guide provided in version 0.1.60

RHEL 9 includes the scap-security-guide packages in version 0.1.60. This version provides bug fixes and enhancements, most notably:

SCAP Security Guide profiles supported in RHEL 9.0

With the SCAP Security Guide compliance profiles included in RHEL 9.0, you can harden the system to the recommendations from the issuing organizations. As a result, you can configure and automate compliance of your RHEL 9 systems according to your required hardening level by using the associated remediations and SCAP profiles.

RHEL 9 provides fapolicyd 1.1

RHEL 9 is distributed with the fapolicyd package version 1.1. Most notable enhancements include the following:

Rsyslog includes the mmfields module for higher-performance operations and CEF

Rsyslog now includes the rsyslog-mmfields subpackage which provides the mmfields module. This is an alternative to using the property replacer field extraction, but in contrast to the property replacer, all fields are extracted at once and stored inside the structured data part. As a result, you can use mmfields particularly for processing field-based log formats, for example Common Event Format (CEF), and if you need a large number of fields or reuse specific fields. In these cases, mmfields has better performance than existing Rsyslog features.

logrotate included in a separate rsyslog-logrotate package

The logrotate config was separated from the main rsyslog package into the new rsyslog-logrotate package. This is useful in certain minimal environments, for example where log rotation is not needed, to prevent installing unnecessary dependencies.

sudo supports Python plugins

With the sudo program version 1.9, which is included in RHEL 9, you can write sudo plugins in Python. This makes it easier to enhance sudo to more precisely suit specific scenarios.

libseccomp provided in version 2.5.2

RHEL 9.0 provides the libseccomp packages in upstream version 2.5.2. This version provides many bug fixes and enhancements over previous versions, most notably:

Clevis now supports SHA-256

With this enhancement, the Clevis framework supports the SHA-256 algorithm as the default hash for JSON Web Key (JWK) thumbprints as recommended by RFC 7638. Because the older thumbprints (SHA-1) are still supported, you can still decrypt the previously encrypted data.

The diag modules are now available in the kernel

The diag modules are now included with the kernel image. With this update, the diag modules no longer need to be dynamically loaded when the ss command is used. This allows better debugging of networking issues regardless of the customer policy on kernel modules. Modules included in the kernel:

New core and IPv4-related networking sysctl kernel parameters

The RHEL 9.0 kernel provides the following new core and IPv4 networking sysctl parameters compared to previous RHEL versions:

Changed behavior in firewalld when transmitting packets between zones

In zone-based firewalls, packets enter only one zone. Implicit packet transmission is the concept violation and can allow traffic or services unexpectedly. In Red Hat Enterprise Linux 9 the firewalld service no longer allows implicit packet transmission between two different zones.

Intra-zone forwarding has been enabled by default

The firewalld intra-zone forwarding feature allows forwarding traffic between interfaces or sources within a firewalld zone. Starting with RHEL 9.0, this feature has been enabled by default. Use the --add-forward option of the firewall-cmd utility to enable intra-zone forwarding for a particular zone. The firewall-cmd --list-all command displays whether intra-zone forwarding is enabled or disabled for a zone:

Making Nmstate more inclusive

Red Hat is committed to using conscious language. Therefore the slave term in the nmstate API has been replaced by the term port.

NetworkManager supports interface names set in the rd.znet_ifname kernel option on IBM Z

With this enhancement, on the IBM Z platform, NetworkManager now interprets the rd.znet and rd.znet_ifname kernel command-line options when installing or booting Red Hat Enterprise Linux from the network. As a result, it is possible to specify a name of a network interface identified by the subchannels instead of the default one.

The hostapd package has been added to RHEL 9.0

With this release, RHEL provides the hostapd package. However, Red Hat supports hostapd only to set up a RHEL host as an 802.1X authenticator in Ethernet networks. Other scenarios, such as Wi-Fi access points or authenticators in Wi-Fi networks, are not supported.

ModemManager provided in version 1.18.2

RHEL 9.0 provides the ModemManager packages in upstream version 1.18.2. This version includes bug fixes and enhancements over the previous version, most notably:

NetworkManager allows to change queue_id of bond port

NetworkManager ports in a bond now supports the queue_id parameter. Assuming eth1 is a port of bond interface, you can enable queue_id for a bond port with:

Support for the configuration of blackhole, prohibit and unreachable route types with latest NetworkManager

Kernel supports several route types besides the common unicast, broadcast and local route types. In addition, users can now configure blackhole, prohibit and unreachable static route types in the connection profile of the NetworkManager. The NetworkManager will add a profile when the profile is activated.

RoCE Express Adapters now use an improved interface naming scheme

With this enhancement, RDMA over Converged Ethernet (RoCE) Express adapters use the predictable interface naming scheme and the Peripheral Communication Interface on z-system (zPCI) connector. In this naming scheme, RHEL uses user identifier (UID) or function identifier (FID) to generate unique names. In case that no unique UID is available, RHEL uses FID to set the naming scheme.

Kernel version in RHEL 9.0

Red Hat Enterprise Linux 9.0 is distributed with the kernel version 5.14.0-70.

Red Hat, by default, enables eBPF in all RHEL versions for privileged users only

Extended Berkeley Packet Filter (eBPF) is a complex technology which allows users to execute custom code inside the Linux kernel. Due to its nature, the eBPF code needs to pass through the verifier and other security mechanisms. There were Common Vulnerabilities and Exposures (CVE) instances, where bugs in this code could be misused for unauthorized operations. To mitigate this risk, Red Hat by default enabled eBPF in all RHEL versions for privileged users only. It is possible to enable eBPF for unprivileged users by using the kernel.command-line parameter unprivileged_bpf_disabled=0.

Red Hat protects kernel symbols only for minor releases

Red Hat guarantees that a kernel module will continue to load in all future updates within an Extended Update Support (EUS) release, only if you compile the kernel module using protected kernel symbols. There is no kernel Application Binary Interface (ABI) guarantee between minor releases of RHEL 9.

RHEL 9 Beta kernels signed with trusted SecureBoot certificates

Previously, RHEL Beta releases required users to enroll a separate Beta public key using the Machine Owner Key (MOK) facility. Starting with RHEL 9 Beta, kernels are signed with trusted SecureBoot certificates, hence users no longer need to enroll a separate Beta public key to use the beta versions on systems having UEFI Secure Boot enabled.

cgroup-v2 enabled by default in RHEL 9

The control groups version 2 (cgroup-v2) feature implements a single hierarchy model that simplifies the management of control groups. Also, it ensures that a process can only be a member of a single control group at a time. Deep integration with systemd improves the end-user experience when configuring resource control on a RHEL system.

Kernel changes potentially affecting third party kernel modules

Linux distributions with a kernel version prior to 5.9 supported exporting GPL functions as non-GPL functions. As a result, users could link proprietary functions to GPL kernel functions through the shim mechanism. With this release, the RHEL kernel incorporates upstream changes that enhance the ability of RHEL to enforce GPL by rebuffing shim.

The 64-bit ARM architecture has a 4 KB page size in RHEL 9

Red Hat has selected a 4 KB page size of physical memory for the 64-bit ARM architecture in Red Hat Enterprise Linux 9. This size pairs well with the workloads and memory amounts present on the majority of ARM-based systems. To employ large page sizes efficiently, use the huge pages option to address a greater amount of memory or workloads with large data sets.

The strace utility now correctly displays SELinux context mismatches

An existing --secontext option of strace has been extended with the mismatch parameter. This parameter enables to print the expected context along with the actual one upon mismatch only. The output is separated by double exclamation marks (!!), first the actual context, then the expected one. In the examples below, the full,mismatch parameters print the expected full context along with the actual one because the user part of the contexts mismatches. However, when using a solitary mismatch, it only checks the type part of the context. The expected context is not printed because the type part of the contexts matches.

perf-top now can sort by a certain column

With this update to the perf-top system profiling tool, you can sort samples by an arbitrary event column. Previously, the events were sorted by the first column in case multiple events in a group were sampled. To sort the samples, use the --group-sort-idx command-line option and press a number key to sort the table by the matching data column. Note that column numbering starts from 0.

New package: jigawatts

Checkpoint/Restore In Userspace (CRIU) is a Linux utility that allows checkpointing and restoring of processes. The jigawatts package contains a Java library, which aims to improve the usability of CRIU mechanisms from Java applications.

The trace-cmd reset command has new behavior

Previously, the trace-cmd reset command resetted the tracing_on configuration to 0. The new behavior of trace-cmd reset is to reset tracing_on to its default value 1.

Extended Berkeley Packet Filter is supported in RHEL 9

The Extended Berkeley Packet Filter (eBPF) is an in-kernel virtual machine that allows code execution in the kernel space, in the restricted sandbox environment with access to a limited set of functions. The virtual machine executes a special assembly-like code.

RHEL 9 provides the crash utility version 8.0.0

RHEL 9 is distributed with the crash utility version 8.0.0. The bug fixes and and notable enhancements include:

makedumpfile now supports an improved zstd compression capability

With this enhancement, the makedumpfile now includes the Zstandard (zstd) compression capability, which provides high compression ratios. This improvement helps specifically on large memory systems.

numatop enabled on Intel Xeon scalable server processors

numatop is a tool that tracks and analyzes the behavior of the processes and threads running on NUMA systems and displays metrics which can identify NUMA-related performance bottlenecks.

kexec_file_load has been added as the default option for RHEL 9

This update adds the kexec_file_load system call for the 64-bit ARM architecture. It provides an in-kernel kexec loader for kdump. Previously, the kernel prevented the loading of unsigned kernel images when the secure boot option was enabled. The kdump mechanism would first try to detect whether secure boot is enabled and then choose the boot interface to run. Consequently, an unsigned kernel failed to load with secure boot enabled and kexec_file_load() specified.

makedumpfile now includes improved options to get an estimated vmcore size

With this implementation, the makedumpfile utility now includes the following options which help to print an estimate for the dump size for the currently running kernel:

The kexec-tools package now supports the default crashkernel memory reservation values for RHEL 9

The kexec-tools package now maintains the default crashkernel memory reservation values. The kdump service uses the default value to reserve the crashkernel memory for each kernel. This implementation also improves memory allocation for kdump when a system has less than 4GB of available memory.

Core scheduling is supported in RHEL 9

With the core scheduling functionality users can prevent tasks that should not trust each other from sharing the same CPU core. Likewise, users can define groups of tasks that can share a CPU core.

Performance improved on 64-bit ARM architecture using non-strict iommu mode as default

With this upgrade, the 64-bit ARM architecture defaults to using the lazy direct memory access (DMA) domain for system memory management unit (SMMU). While bringing a significant performance gain, it can introduce a window between an address unmap and a Translation Lookaside Buffer (TLB) flush on SMMU. On previous versions, the 64-bit ARM architecture configured the strict DMA domains as default, which caused the performance to drop due to the 4KB page size.

The kernel-rt source tree has been updated to RHEL 9.0 tree

The kernel-rt sources have been updated to use the latest Red Hat Enterprise Linux kernel source tree. The real-time patch set has also been updated to the latest upstream version, v5.15-rt19. These updates provide a number of bug fixes and enhancements.

Support for CPU hotplug in the hv_24x7 and hv_gpci PMUs

With this update, PMU counters correctly react to the hot-plugging of a CPU. As a result, if a hv_gpci event counter is running on a CPU that gets disabled, the counting redirects to another CPU.

Metrics for POWERPC hv_24x7 nest events are now available

Metrics for POWERPC hv_24x7 nest events are now available for perf. By aggregating multiple events, these metrics provide a better understanding of the values obtained from perf counters and how effectively the CPU is able to process the workload.

The IRDMA driver has been introduced in RHEL 9

The IRDMA driver enables RDMA functionality on RDMA-capable Intel® network devices. Devices supported by this driver are:

A new parameter for the kernel bonding module: lacp_active

RHEL 9 introduces the lacp_active parameter for the bonding kernel module. This parameter specifies whether to send Link Aggregation Control Protocol Data Unit (LACPDU) frames at specified intervals. The options are as follows:

Boot loader configuration files are unified across CPU architectures

Configuration files for the GRUB boot loader are now stored in the /boot/grub2/ directory on all supported CPU architectures. The /boot/efi/EFI/redhat/grub.cfg file, which GRUB previously used as the main configuration file on UEFI systems, now simply loads the /boot/grub2/grub.cfg file.

Options in Samba utilities have been renamed and removed for a consistent user experience

The Samba utilities have been improved to provide a consistent command-line interface. These improvements include renamed and removed options. Therefore, to avoid problems after the update, review your scripts that use Samba utilities, and update them, if necessary.

GFS2 file systems are now created with format version 1802

GFS2 file systems in RHEL 9 are created with format version 1802. This enables the following features:

RHEL 9 provides nvml package version 1.10.1

RHEL 9.0 updates the nvml package to version 1.10.1. This update adds features and fixes a potential data corruption bug on power loss.

Support for exFAT file system has been added

RHEL 9.0 supports Extensible File Allocation Table (exFAT) file system. You can now mount, format, and generally use this file system, which is usually used by default on flash memory.

rpcctl command now displays SunRPC connection information

With this update, you can use the rpcctl command to display information collected in the SunRPC sysfs files about the system’s SunRPC objects. You can show, remove, and set objects in the SunRPC network layer through the sysfs file system.

Limiting the set of the devices for LVM

By default, LVM in RHEL 9 uses only the devices that you explicitly select. Use the new commands lvmdevices and vgimportdevices to select specific devices. Using the pvcreate, vgcreate, and vgextend commands indirectly selects new devices for lvm, if they have not already been selected. LVM ignores devices that are attached to the system until you select them by using one of these commands. The lvm command saves the list of the selected devices in the devices file /etc/lvm/devices/system.devices. The lvm.conf filter or any other command-line configuration filter does not function when you enable the new devices file feature. If you remove or disable the devices file, LVM applies the filter to all attached devices. For detailed information about this feature, see the lvmdevices(8) man page.

NVMe/TCP host with nvme_tcp.ko is now fully supported

Nonvolatile Memory Express (NVMe) storage over TCP/IP networks (NVMe/TCP) with the nvme_tcp.ko kernel module is now fully supported. The NVMe/TCP target with the nvmet_tcp.ko module is available with an Unmaintained status in RHEL 9.0.

multipathd now supports detecting FPIN-Li events

When you add a new value fpin for the marginal_pathgroups config option, you enable multipathd to monitor the Link Integrity Fabric Performance Impact Notification (PFIN-Li) events and move paths with link integrity issues to a marginal pathgroup. With the fpin value set, multipathd overrides its existing marginal path detection methods and relies on the Fibre Channel fabric to identify link integrity issues.

The resource-stickiness resource meta-attribute now defaults to 1 instead of 0 for newly-created clusters

Previously, the default value for the resource-stickiness resource meta-attribute had a default value of 0 for newly-created clusters. This meta-attribute now defaults to 1.

New LVM volume group flag to control autoactivation

LVM volume groups now support a setautoactivation flag which controls whether logical volumes that you create from a volume group will be automatically activated on startup. When creating a volume group that will be managed by Pacemaker in a cluster, set this flag to n with the vgcreate --setautoactivation n command for the volume group to prevent possible data corruption. If you have an existing volume group used in a Pacemaker cluster, set the flag with vgchange --setautoactivation n.

New pcs resource status display commands

The pcs resource status and the pcs stonith status commands now support the following options:

New reduced output display option for pcs resource safe-disable command

The pcs resource safe-disable and pcs resource disable --safe commands print a lengthy simulation result after an error report. You can now specify the --brief option for those commands to print errors only. The error report now always contains resource IDs of affected resources.

New pcs command to update SCSI fencing device without causing restart of all other resources

Updating a SCSI fencing device with the pcs stonith update command causes a restart of all resources running on the same node where the stonith resource was running. The new pcs stonith update-scsi-devices command allows you to update SCSI devices without causing a restart of other cluster resources.

Ability to configure watchdog-only SBD for fencing on subset of cluster nodes

Previously, to use a watchdog-only SBD configuration, all nodes in the cluster had to use SBD. That prevented using SBD in a cluster where some nodes support it but other nodes (often remote nodes) required some other form of fencing. Users can now configure a watchdog-only SBD setup using the new fence_watchdog agent, which allows cluster configurations where only some nodes use watchdog-only SBD for fencing and other nodes use other fencing types. A cluster may only have a single such device, and it must be named watchdog.

Detailed Pacemaker status display for internal errors

If Pacemaker can not execute a resource or fence agent for some reason, for example the agent is not installed or there has been an internal timeout, the Pacemaker status displays now show a detailed exit reason for the internal error.

The pcmk_delay_base parameter may now take different values for different nodes

When configuring a fence device, you now can specify different values for different nodes with the pcmk_delay_base parameter. This allows a single fence device to be used in a two-node cluster, with a different delay for each node. This helps prevent a situation where each node attempts to fence the other node at the same time. To specify different values for different nodes, you map the host names to the delay value for that node using a similar syntax to pcmk_host_map. For example, node1:0;node2:10s would use no delay when fencing node1 and a 10-second delay when fencing node2.

Support for special characters inside pcmk_host_map values

The pcmk_host_map property now supports special characters inside pcmk_host_map values using a backslash (\) in front of the value. For example, you can specify pcmk_host_map="node3:plug\ 1" to include a space in the host alias.

New fencing agent for OpenShift

The fence_kubevirt fencing agent is now available for use with RHEL High Availability on Red Hat OpenShift Virtualization. For information on the fence_kubevirt agent, see the fence_kubevirt(8) man page.

Local mode version of pcs cluster setup command is now fully supported

By default, the pcs cluster setup command automatically synchronizes all configuration files to the cluster nodes. The pcs cluster setup command now fully supports the --corosync-conf option. Specifying this option switches the command to local mode. In this mode, the pcs command-line interface creates a corosync.conf file and saves it to a specified file on the local node only, without communicating with any other node. This allows you to create a corosync.conf file in a script and handle that file by means of the script.

Automatic removal of location constraint following resource move

When you execute the pcs resource move command, this adds a constraint to the resource to prevent it from running on the node on which it is currently running. By default, the location constraint that the command creates is automatically removed once the resource has been moved. This does not necessarily move the resources back to the original node; where the resources can run at that point depends on how you have configured your resources initially. If you would like to move a resource and leave the resulting constraint in place, use the pcs resource move-with-contraint command.

pcs suppport for OCF Resource Agent API 1.1 standard

The pcs command-line interface now supports OCF 1.1 resource and STONITH agents. As part of the implementation of this support, any agent’s metadata must comply with the OCF schema, whether the agent is an OCF 1.0 or OCF 1.1 agent. If an agent’s metadata does not comply with the OCF schema, pcs considers the agent invalid and will not create or update a resource of the agent unless the --force option is specified. The pcsd Web UI and pcs commands for listing agents now omit agents with invalid metadata from the listing.

pcs now accepts Promoted and Unpromoted as role names

The pcs command-line interface now accepts Promoted and Unpromoted anywhere roles are specified in Pacemaker configuration. These role names are the functional equivalent of the Master and Slave Pacemaker roles in previous RHEL releases, and these are the role names that are visible in configuration displays and help pages.

Updated version of pcsd Web UI

The pcsd Web UI, the graphical user interface to create and configure Pacemaker/Corosync clusters, has been updated. The updated Web UI provides an improved user experience and a standardized interface that is built with the PatternFly framework used in other Red Hat web applications.

Python in RHEL 9

Python 3.9 is the default Python implementation in RHEL 9. Python 3.9 is distributed in a non-modular python3 RPM package in the BaseOS repository and usually installed by default. Python 3.9 will be supported for the whole life cycle of RHEL 9.

Node.js 16 available in RHEL 9

RHEL 9 provides a Long Term Support (LTS) version 16 of Node.js, a software development platform for building fast and scalable network applications in the JavaScript programming language.

RHEL 9 provides Ruby 3.0

RHEL 9 is distributed with Ruby 3.0.3, which provides a number of performance improvements, bug and security fixes, and new features over Ruby 2.7.

RHEL 9 introduces Perl 5.32

RHEL 9 includes Perl 5.32, which provides a number of bug fixes and enhancements over version 5.30.

RHEL 9 includes PHP 8.0

RHEL 9 is distributed with PHP 8.0, which provides a number of bug fixes and enhancements over version 7.4.

RHEL 9 provides Git 2.31 and Git LFS 2.13

RHEL 9 is distributed with Git 2.31 which provides a number of enhancements and performance improvements over version 2.27 available in RHEL 8. Notable changes include:

Subversion 1.14 in RHEL 9

RHEL 9 is distributed with Subversion 1.14. Subversion 1.14 is the initial version of this Application Stream, which you can install easily as an RPM package. Additional Subversion versions will be provided as modules with a shorter life cycle in future minor releases of RHEL 9.

Notable changes in the Apache HTTP Server

RHEL 9.0 provides version 2.4.51 of the Apache HTTP Server. Notable changes over version 2.4.37 include:

nginx 1.20 available in RHEL 9

RHEL 9 includes the nginx 1.20 web and proxy server. This release provides a number of bug fixes, security fixes, new features and enhancements over version 1.18.

Varnish Cache 6.6 in RHEL 9

RHEL 9 includes Varnish Cache 6.6, a high-performance HTTP reverse proxy.

RHEL 9 introduces Squid 5

RHEL 9 is distributed with Squid 5.2, a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. This release provides a number of bug fixes, security fixes, new features, and enhancements over version 4.

MariaDB 10.5 in RHEL 9

RHEL 9 provides MariaDB 10.5. MariaDB 10.5 is the initial version of this Application Stream, which you can install easily as an RPM package. Additional MariaDB versions will be provided as modules with a shorter life cycle in future minor releases of RHEL 9.

RHEL 9 includes MySQL 8.0

RHEL 9 is distributed with MySQL 8.0. MySQL 8.0 is the initial version of this Application Stream, which you can install easily as an RPM package. MySQL 8.0 has a shorter life cycle than RHEL 9. For details, see the Red Hat Enterprise Linux Application Streams Life Cycle document.

RHEL 9 provides PostgreSQL 13

PostgreSQL 13 is available with RHEL 9. PostgreSQL 13 is the initial version of this Application Stream, which you can install easily as an RPM package. Additional PostgreSQL versions will be provided as modules with a shorter life cycle in future minor releases of RHEL 9.

Redis 6.2 in RHEL 9

RHEL 9 is distributed with Redis 6.2, which provides a number of bug and security fixes and enhancements over version 6.0 available in RHEL 8.

New package: perl-Module-Signature

RHEL 9 introduces the perl-Module-Signature Perl module. With this new module, you can enable signature checking for cpan to mitigate CVE-2020-16156. For more information, see How to mitigate CVE-2020-16154 in perl-App-cpanminus and CVE-2020-16156 in perl-CPAN.

RHEL 9 provides support for IBM POWER10 processors

From the Linux kernel, through the system toolchain (GCC, binutils, glibc), Red Hat Enterprise Linux 9 has been updated to include support for IBM’s latest POWER processor, POWER10. RHEL 9 is production ready for workloads on POWER10, with enhancements coming in future releases.

GCC 11.2.1 is available

RHEL 9 is distributed with GCC version 11.2.1. Notable bug fixes and enhancements include:

New command for capturing glibc optimization data

The new ld.so --list-diagnostics command captures data that influences glibc optimization decisions, such as IFUNC selection and glibc-hwcaps configuration, in a single machine-readable file.

Notable changes to binutils

RHEL 9 introduces the following changes to binutils:

sched_getcpu implementation can now, optionally, use rseq (restartable sequences) to improve performance on the 64-bit ARM architectures and other architectures

The previous implementation of sched_getcpu on the 64-bit ARM architectures uses the getcpu system call, which is too slow for efficient use in most parallel algorithms. Other architectures use vDSO (virtual dynamic shared object) acceleration to work around this. Implementing sched_getcpu using rseq greatly improves performance on the 64-bit ARM architectures. Other architectures see a slight improvement.

Updated performance tools and debuggers

The following performance tools and debuggers are available with RHEL 9.0:

DAWR functionality improved in GDB on IBM POWER10

RHEL 9 is distributed with GDB 10.2 that provides improved DAWR functionality. New hardware watchpoint capabilities are enabled for GDB on the IBM POWER10 processors. For example, a new set of DAWR/DAWRX registers has been added.

GDB supports new prefixed instructions on IBM POWER10

GDB 10.2 fully supports the Power ISA 3.1 prefixed instructions on POWER10, which include eight-byte prefixed instructions. In RHEL 8.4, GDB only supported four-byte instructions.

RHEL 9 provides boost 1.75.0

RHEL 9 is distributed with the boost package version 1.75.0. Notable bug fixes and enhancements over version 1.67.0 include:

RHEL 9 provides LLVM Toolset 13.0.1

RHEL 9 is distributed with LLVM Toolset version 13.0.1. Notable bug fixes and enhancements over version 12.0.1 include:

Notable changes in CMake 3.20.2

RHEL 9 is distributed with CMake 3.20.2. To use CMake on a project that requires version 3.20.2 or less, use the command cmake_minimum_required(version 3.20.2).

RHEL 9 provides Go 1.17.7

RHEL 9 is distributed with Go Toolset version 1.17.7. Notable bug fixes and enhancements over version 1.16.7 include:

Go FIPS mode is supported with OpenSSL 3

You can now use the OpenSSL 3 library when in Go FIPS mode.

RHEL 9 provides Rust Toolset 1.58.1

RHEL 9 is distributed with Rust Toolset version 1.58.1. Notable bug fixes and enhancements over version 1.54.0 include:

RHEL 9 provides the pcp package version 5.3.5

RHEL 9 is distributed with the Performance Co-Pilot (pcp) package version 5.3.5. Since version 5.3.1, a new pcp-pmda-bpf sub-package has been added which provides performance data from eBPF programs utilizing BPF CO-RE (libbpf and BTF).

Active Directory authentication for accessing SQL Server metrics in PCP

With this update, a system administrator can configure pmdamssql(1) to connect securely to the SQL Server metrics using Active Directory (AD) authentication.

The new pcp-ss PCP utility is now available

The pcp-ss PCP utility reports socket statistics collected by the pmdasockets(1) PMDA. The command is compatible with many of the ss command line options and reporting formats. It also offers the advantages of local or remote monitoring in live mode and historical replay from a previously recorded PCP archive.

RHEL 9 provides grafana 7.5.11

RHEL 9 is distributed with the grafana package version 7.5.11. Notable changes over version 7.5.9 include:

RHEL 9 provides grafana-pcp 3.2.0

RHEL 9 is distributed with the grafana-pcp package version 3.2.0. Notable bug fixes and enhancements over version 3.1.0 include:

Accessing remote hosts through a central pmproxy for the Vector data source in grafana-pcp

In some environments, the network policy does not allow connections from the dashboard viewer’s browser to the monitored hosts directly. This update makes it possible to customize the hostspec in order to connect to a central pmproxy, which forwards the requests to the individual hosts.

A new package: ansible-pcp

The ansible-pcp package contains roles for Performance Co-Pilot (PCP) and related software, such as Redis and Grafana, used to implement the metrics RHEL system role.

RHEL 9 provides python-jsonpointer 2.0

RHEL 9 is distributed with the python-jsonpointer package version 2.0.

.NET 6.0 is available

RHEL 9 is distributed with .NET version 6.0. Notable improvements include:

Java implementations in RHEL 9

The RHEL 9 AppStream repository includes:

Java tools in RHEL 9

The RHEL 9 AppStream repository includes the following Java tools:

SWIG 4.0 available in the CRB repository

The Simplified Wrapper and Interface Generator (SWIG) version 4.0 is available in the CodeReady Linux Builder (CRB) repository. This release adds support for PHP 8.

Directory Server no longer uses a global changelog

With this enhancement, the Directory Server changelog has been integrated into the main database. Previously, Directory Server used a global changelog. However, this could cause issues if the directory used multiple databases. As a result, each suffix has now its own changelog in the same directory as the regular database files.

ansible-freeipa is now available in the AppStream repository with all dependencies

Previously in RHEL 8, before installing the ansible-freeipa package, you first had to enable the Ansible repository and install the ansible package. In RHEL 8.6 and RHEL 9, you can install ansible-freeipa without any preliminary steps. Installing ansible-freeipa automatically installs the ansible-core package, a more basic version of ansible, as a dependency. Both ansible-freeipa and ansible-core are available in the rhel-9-for-x86_64-appstream-rpms repository.

IdM now supports the automountlocation, automountmap, and automountkey Ansible modules

With this update, the ansible-freeipa package contains the ipaautomountlocation, ipaautomountmap, and ipaautomountkey modules. You can use these modules to configure directories to be mounted automatically for IdM users logged in to IdM clients in an IdM location. Note that currently, only direct maps are supported.

The support for managing subID ranges is available in the shadow-utils

Previously, shadow-utils configured the subID ranges automatically from the /etc/subuid and /etc/subgid files. With this update, the configuration of subID ranges is available in the /etc/nsswitch.conf file by setting a value in the subid field. For more information, see man subuid and man subgid. Also, with this update, an SSSD implementation of the shadow-utils plugin is available, which provides the subID ranges from the IPA server. To use this functionality, add the subid: sss value to the /etc/nsswitch.conf file. This solution might be useful in the containerized environment to facilitate rootless containers.

Support for managing subID ranges is available in IdM

With this update, you can manage ID subranges for users in Identity Management. You can use the ipa CLI tool or IdM WebUI interface to assign automatically configured subID ranges to a user, which might be useful in a containerized environment.

Identity Management installation packages have been demodularized

Previously in RHEL 8, IdM packages were distributed as modules, which required you to enable a stream and install the profile that corresponds to your desired installation. IdM installation packages have been demodularized in RHEL 9, so you can use the following dnf commands to install IdM server packages:

An alternative to the traditional RHEL ansible-freeipa repository: Ansible Automation Hub

With this update, you can download ansible-freeipa modules from the Ansible Automation Hub (AAH) instead of downloading them from the standard RHEL repository. By using AAH, you can benefit from the faster updates of the ansible-freeipa modules available in this repository.

ansible-freeipa modules can now be executed remotely on IdM clients

Previously, ansible-freeipa modules could only be executed on IdM servers. This required your Ansible administrator to have SSH access to your IdM server, causing a potential security threat. With this update, you can execute ansible-freeipa modules remotely on systems that are IdM clients. As a result, you can manage IdM configuration and entities in a more secure way.

The ipadnsconfig module now requires action: member to exclude a global forwarder

With this update, excluding global forwarders in Identity Management (IdM) by using the ansible-freeipa ipadnsconfig module requires using the action: member option in addition to the state: absent option. If you only use state: absent in your playbook without also using action: member, the playbook fails. Consequently, to remove all global forwarders, you must specify all of them individually in the playbook. In contrast, the state: present option does not require action: member.

Automatic private groups for AD users support centralized configuring

You can now centrally define how compatible versions of SSSD on IdM clients manage private groups for users from trusted Active Directory domains. With this enhancement, you can now explicitly set the value for SSSD’s auto_private_groups option for an ID range that handles AD users.

Customizable logging settings for BIND

With this enhancement, you can now configure logging settings for the BIND DNS server component of an Identity Management server in the /etc/named/ipa-logging-ext.conf configuration file.

Autodiscovery of IdM servers when retrieving an IdM keytab

With this enhancement, you no longer need to specify an IdM server host name when retrieving a Kerberos keytab with the ipa-getkeytab command. If you do not specify a server host name, DNS discovery is used to find an IdM server. If no servers are found, the command falls back to the host value specified in the /etc/ipa/default.conf configuration file.

RHEL 9 provides Samba 4.15.5

RHEL 9 is distributed with Samba 4.15.5, which provides bug fixes and enhancements over version 4.14:

Tracking client requests using the log analyzer tool

The System Security Services Daemon (SSSD) now includes a log parsing tool which tracks requests from start to finish across log files from multiple SSSD components.

SSSD now logs backtraces by default

With this enhancement, SSSD now stores detailed debug logs in an in-memory buffer and appends them to log files when a failure occurs. By default, the following error levels trigger a backtrace:

SSSD default SSH hashing value is now consistent with the OpenSSH setting

The default value of ssh_hash_known_hosts has been changed to false. It is now consistent with the OpenSSH setting, which does not hash host names by default.

Directory Server 12.0 is based on upstream version 2.0.14

Directory Server 12.0 is based on upstream version 2.0.14 which provides a number of bug fixes and enhancements over the previous version. For a complete list of notable changes, read the upstream release notes before updating:

Directory Server now stores memory-mapped files of databases on a tmpfs file system

In Directory Server, the nsslapd-db-home-directory parameter defines the location of memory-mapped files of databases. This enhancement changes the default value of the parameter from /var/lib/dirsrv/slapd-instance_name/db/ to /dev/shm/. As a result, with the internal databases stored on a tmpfs file system, the performance of Directory Server increases.

FreeRADIUS support is now redesigned

In RHEL 9, the existing FreeRADIUS offering is now streamlined and aligned more closely with the strategic direction of Identity Management (IdM). In order to provide the best support for IdM customers, Red Hat is strengthening support for these external authentication modules with FreeRADIUS:

The RHEL IdM named daemon now uses OpenSSL to ensure DNSSEC validation

With this update, the named daemon in RHEL Identity Management (IdM) has adopted the OpenSSL PKCS#11 engine to secure DNS data with a digital signature to protect DNS from attacks. Previously, IdM used a special version of the bind package, namely bind-pkcs11, for this purpose. Additionally, this update removes the bind-pkcs11-utils package. Use pkcs11-tool from the opensc package to manage PKCS#11 tokens or stored keys instead.

GNOME updated to version 40

The GNOME environment is now updated from GNOME 3.28 to GNOME 40 with many new features.

PipeWire is now the default audio service

The Pipewire service now manages all audio output and input. Pipewire replaces the PulseAudio service in general use cases and the JACK service in professional use cases. The system now redirects audio from applications that use PulseAudio, JACK, or the ALSA framework into Pipewire.

Power profiles are available in GNOME

You can now switch between several power profiles in the Power panel of Settings in the GNOME environment. The power profiles optimize various system settings for the selected goal.

Language support is now provided by langpacks

Support for various languages is now available from langpacks packages. You can customize the level of language support that you want to install using the following package names, where code is the short ISO code for the language, such as es for Spanish:

Lightweight, single-application environment

For graphical use cases that only present a single application, a lightweight user interface (UI) is now available.

Security classification banners at login and in the desktop session

You can now configure classification banners to state the overall security classification level of the system. This is useful for deployments where the user must be aware of the security classification level of the system that they are logged into.

The default wallpaper adds a Red Hat logo

The default RHEL wallpaper now displays a Red Hat logo. The logo is located in the upper left corner of the screen.

Firefox now uses stronger encryption in PKCS#12 files

The Firefox web browser uses PKCS#12 files to establish client authentication certificates. Previously, Firefox encrypted these files using legacy algorithms:

The Wayland session is now the default with NVIDIA drivers

When using the NVIDIA drivers, the desktop session now selects the Wayland display protocol by default, if the driver configuration supports Wayland. In previous RHEL releases, the NVIDIA drivers always disabled Wayland.

Smart card authentication for sudo and SSH from the web console

Previously, it was not possible to use smart card authentication to obtain sudo privileges or use SSH in the web console. With this update, Identity Management users can use a smart card to gain sudo privileges or to connect to a different host with SSH.

Kernel security patches without reboot in the web console

This web console update allows users to apply kernel security patches without forcing reboots by using the kpatch framework. Administrators can also automatically subscribe any future kernel to the live patching stream.

RHEL web console provides Insights registration by default

With this update, when you use the Red Hat Enterprise Linux web console to register a RHEL system, the Connect this system to Red Hat Insights. check box is checked by default. If you do not want to connect to the Insights service, uncheck the box.

Cockpit now supports using an existing TLS certificate

With this enhancement, the certificate does not have strict file permission requirements any more (such as root:cockpit-ws 0640), and thus it can be shared with other services.

The Networking system role now supports SAE

In Wi-Fi protected access version 3 (WPA3) networks, the simultaneous authentication of equals (SAE) method ensures that the encryption key is not transmitted. With this enhancement, the Networking RHEL system role supports SAE. As a result, administrators can now use the Networking system role to configure connections to Wi-Fi networks, which use WPA-SAE.

The Networking system role now supports owe

The Networking RHEL system role now supports Opportunistic Wireless Encryption (owe). owe is a wireless authentication key management type that uses encryption between Wi-Fi clients and access points, and protects Wi-Fi clients from sniffing attacks. To use owe, set the wireless authentication key management type,key_mgmt field, to owe.

The Firewall system role now supports setting the firewall default zone

Zones represent a concept to manage incoming traffic more transparently. The zones are connected to networking interfaces or assigned a range of source addresses. Firewall rules for each zone are managed independently enabling the administrator to define complex firewall settings and apply them to the traffic. This feature allows setting the default zone used as the default zone to assign interfaces to, same as firewall-cmd --set-default-zone zone-name.

The Storage RHEL system role now supports LVM VDO volumes

With this enhancement, you can use the Storage system role to manage Logical Manager Volumes (LVM) Virtual Data Optimizer (VDO) volumes. The LVM filesystem manages VDO volumes and with this feature, it is now possible to compress and deduplicate on LVM volumes. As a result, VDO helps to optimize the usage of the storage volumes.

Support for volume sizes expressed as a percentage is available in the Storage system role

This enhancement adds support to the Storage RHEL system role to express LVM volume sizes as a percentage of the pool’s total size. You can specify the size of LVM volumes as a percentage of the pool/VG size, for example: 50% in addition to the human-readable size of the file system, for example, 10g, 50 GiB.

Support for cached volumes is available in the Storage system role

This enhancement adds support to the Storage RHEL system role to create and manage cached LVM logical volumes. LVM cache can be used to improve performance of slower logical volumes, by temporarily storing subsets of an LV’s data on a smaller, faster device, for example, an SSD.

Ability to add or remove sources to the Firewall role

This update enables you to add or remove sources in the firewall settings configuration using the source parameter.

New Ansible Role for Microsoft SQL Server Management

The new microsoft.sql.server role is designed to help IT and database administrators automate processes involved with setup, configuration, and performance tuning of SQL Server on Red Hat Enterprise Linux.

Microsoft SQL system role now supports customized repository for disconnected or Satellite subscriptions

Previously, users in disconnected environments that needed to pull packages from a custom server or Satellite users that needed to point to Satellite or Capsule had no support from the microsoft.sql.server role. This update fixes it by providing the mssql_rpm_key, mssql_server_repository, and mssql_client_repository variables that you can use to customize the repositories to download packages from. If no URL is provided, the mssql role uses the official Microsoft servers to download RPMs.

The MSSQL role consistently uses "Ansible_managed" comment in its managed configuration files

The MSSQL role generates the /var/opt/mssql/mssql.conf configuration file. With this update, the MSSQL role inserts the "Ansible managed" comment to the configuration files, using the Ansible standard ansible_managed variable. The comment indicates that the configuration files should not be directly edited because the MSSQL role can overwrite the file. As a result, the configuration files contain a declaration stating that the configuration files are managed by Ansible.

Ansible Core support for the RHEL system roles

As of the RHEL 9 GA release, Ansible Core is provided, with a limited scope of support, to enable RHEL supported automation use cases. Ansible Core replaces Ansible Engine which was provided on previous versions of RHEL in a separate repository. Ansible Core is available in the AppStream repository for RHEL. For more details on the supported use cases, see Scope of support for the Ansible Core package included in the RHEL 9 AppStream.

Support for configuring multiple elasticsearch hosts in one elasticsearch output dictionary

Previously, the server_host parameter used to take a string value for a single host. This enhancement adjusts it to the underlying rsyslog omelasticsearch’s specification, so it now also takes a list of strings to support multiple hosts. Consequently, it is adjusted to hosts, following the underlying rsyslog omelasticsearch’s specification. As a result, users can configure multiple elasticsearch hosts in one elasticsearch output dictionary.

RHEL system roles now support VPN management

Previously, it was difficult to set up secure and properly configured IPsec tunneling and virtual private networking (VPN) solutions on Linux. With this enhancement, you can use the VPN RHEL system role to set up and configure VPN tunnels for host-to-host and mesh connections more easily across large numbers of hosts. As a result, you have a consistent and stable configuration interface for VPN and IPsec tunneling configuration within the RHEL system roles project.

The SSHD RHEL system role now supports non-exclusive configuration snippets

With this feature, you can configure SSHD through different roles and playbooks without rewriting the previous configurations by using namespaces. Namespaces are similar to a drop-in directory, and define non-exclusive configuration snippets for SSHD. As a result, you can use the SSHD RHEL system role from a different role, if you need to configure only a small part of the configuration and not the entire configuration file.

Network Time Security (NTS) option added to the timesync RHEL system role

The NTS option was added to the Timesync RHEL system role to enable NTS on client servers. NTS is a new security mechanism specified for Network Time Protocol (NTP). NTS can secure synchronization of NTP clients without client-specific configuration and can scale to large numbers of clients. The NTS option is supported only with the chrony NTP provider in version 4.0 and later.

Support for HA Cluster RHEL system role

The High Availability Cluster (HA Cluster) role is now fully supported. The following notable configurations are available:

Support for Rsyslog username and password authentication to Elasticsearch

This update adds the Elasticsearch username and password parameters to the Logging system role. As a result, you can enable Rsyslog to authenticate to Elasticsearch using a username and password.

The NBDE Client system role supports static IP addresses

In previous versions of RHEL, restarting a system with a static IP address and configured with the Network Bound Disk Encryption (NBDE) Client system role would change the system’s IP address. With this change, systems with static IP addresses are supported by the NBDE Client system role, and their IP addresses do not change after a reboot.

Support for specifying raid_level for LVM has been added

RHEL 9.0 supports grouping Logical Volume Management (LVM) volumes into RAIDs using the lvmraid feature.

The Certificate role consistently uses "Ansible_managed" comment in its hook scripts

With this enhancement, the Certificate role generates pre-scripts and post-scripts to support providers, to which the role inserts the "Ansible managed" comment using the Ansible standard "ansible_managed" variable:

A new option auto_gateway controls the default route behavior

Previously, the DEFROUTE parameter was not configurable with configuration files but only manually configurable by naming every route. This update adds a new auto_gateway option in the ip configuration section for connections, with which you can control the default route behavior. You can configure auto_gateway in the following ways:

Support to all bonding options added to the network system role

This update provides support to all bonding options to the network RHEL system role. Consequently, it enables you to flexibly control the network transmission over the bonded interface. As a result, you can control the network transmission over the bonded interface by specifying several options to that interface.

NetworkManager supports specifying a network card using its PCI address

Previously, during setting a connection profile, NetworkManager was only allowed to specify a network card using either its name or MAC address. In this case, the device name is not stable and the MAC address requires inventory to maintain record of used MAC addresses. Now, you can specify a network card based on its PCI address in a connection profile.

The Network system role now directly manages the configuration files of Ansible

With this enhancement, the network role generates ifcfg files in /etc/sysconfig/network-scripts. Then, it inserts the comment “Ansible managed”, using the standard ansible_managed variable. This comment indicates that the ifcfg files are not directly editable as the network role may overwrite it. The important difference in handling the ifcfg file to add "Ansible managed" comment is that the network role uses the initscripts package while the NetworkManager uses the nm package.

Ansible Core support for RHEL system roles

In RHEL 9.0, Ansible Core is provided, with a limited scope of support, to enable RHEL supported automation use cases. Ansible Core replaces Ansible Engine which was previously provided in a separate repository. Ansible Core is available in the AppStream repository for RHEL. For more details on the supported use cases, see Scope of support for the Ansible Core package included in the RHEL 9 and RHEL 8.6 and later AppStream repositories. Users must manually migrate their systems from Ansible Engine to Ansible Core.

The Cockpit system role is now supported

With this enhancement, you can install and configure the web console in your system. Consequently, you can manage web console in an automated manner.

The Terminal session recording system role uses the "Ansible managed" comment in its managed configuration files

The Terminal session recording role generates 2 configuration files:

The VPN role consistently uses "Ansible_managed" comment in its managed configuration files

The VPN role generates the following configuration file:

The Postfix role consistently uses "Ansible_managed" comment in its managed configuration files

The Postfix role generates the /etc/postfix/main.cf configuration file. With this update, the Postfix role inserts the "Ansible managed" comment to the configuration files, using the Ansible standard ansible_managed variable. The comment indicates that the configuration files should not be directly edited because the Postfixrole can overwrite the file. As a result, the configuration files contain a declaration stating that the configuration files are managed by Ansible.

The Firewall RHEL system role has been added in RHEL 9

With this enhancement, the rhel-system-roles.firewall RHEL system role was added to the rhel-system-roles package. As a result, administrators can automate their firewall settings for managed nodes.

The SSH client RHEL system role now supports new configuration options in OpenSSH 8.7

With this enhancement, OpenSSH was updated to the latest version, which provides new configuration options that are available in the SSH client role for configuring new hosts.

RHEL web console new virtualization features

With this update, the RHEL web console includes new features in the Virtual Machines page. You can now:

QEMU uses Clang

The QEMU emulator is now built using the Clang compiler. This enables the RHEL 9 KVM hypervisor to use a number of advanced security and debugging features, and makes future feature development more efficient.

SafeStack for virtual machines

In RHEL 9 on AMD64 and Intel 64 hardware (x86_64), the QEMU emulator can use SafeStack, an enhanced compiler-based stack protection feature. SafeStack reduces the ability of an attacker to exploit a stack- based buffer overflow to change return pointers in the stack and create Return-Oriented Programming (ROP) attacks. As a result, virtual machines hosted on RHEL 9 are significantly more secure against ROP-based vulnerabilities.

virtiofs full support on Intel 64, AMD64, and IBM Z

The virtio file system (virtiofs) is now fully supported on Intel 64, AMD64, and IBM Z architectures. Using virtiofs, you can efficiently share files between your host system and its virtual machines.

AMD EPYC 7003 series processors supported on KVM guests

Support for AMD EPYC 7003 series processors (also known as AMD Milan) has now been added to the KVM hypervisor and kernel code, and to the libvirt API. This enables KVM virtual machines to use AMD EPYC 7003 series processors.

qemu-kvm now supports additional machine types

A set of new machine types, based on RHEL 9, has been added for use by virtual machines (VMs). To obtain all currently supported machine types on your host, use the /usr/libexec/qemu-kvm -M help command.

Mediated devices are now supported by virtualization CLIs on IBM Z

Using virt-install or virt-xml, you can now attach mediated devices to your VMs, such as vfio-ap and vfio-ccw. This for example enables more flexible management of DASD storage devices and cryptographic coprocessors on IBM Z hosts. In addition, using virt-install, you can create a VM that uses an existing DASD mediated device as its primary disk. For instructions to do so, see the Configuring and Managing Virtualization in RHEL 9 guide.

Modular libvirt daemons

In RHEL 9, the libvirt library uses modular daemons that handle individual virtualization driver sets on your host. For example, the virtqemud daemon handles QEMU drivers. This makes it possible to fine-grain a variety of tasks that involve virtualization drivers, such as resource load optimization and monitoring.

Windows 11 and Windows Server 2022 guests are supported

RHEL 9 supports using Windows 11 and Windows Server 2022 as the guest operating systems on KVM virtual machines.

ksmtuned is now distributed separately from qemu-kvm

To decrease the footprint of the KVM hypervisor, the ksmtuned utility is no longer a dependency of qemu-kvm. As a consequence, if you require configuring kernel same-page merging (KSM), you must install the ksmtuned package manually.

New feature: vTPM

The Virtual Trusted Platform Module (vTPM) is fully supported in RHEL 9. Using vTPM, you can add a TPM virtual crypto-processor to a virtual machine (VM) running in the RHEL 9 KVM hypervisor. This makes it possible to use the VM for generating, storing, and managing cryptographic keys.

Virtualization support for Intel Atom P59 series processors

With this update, virtualization on RHEL 9 adds support for the Intel Atom P59 series processors, formerly known as Snow Ridge. As a result, virtual machines hosted on RHEL 9 can now use the Snowridge CPU model and utilise new features that the processors provide.

RHEL 9 provides WALinuxAgent 2.3.0.2

RHEL 9 is distributed with the Windows Azure Linux Agent (WALinuxAgent) package version 2.3.0.2. Notable bug fixes and enhancements over version 2.2.49 include:

RHEL on Azure now supports MANA

RHEL 9 virtual machines running on Microsoft Azure can now use the Microsoft Azure Network Adapter (MANA).

cloud-init supports the VMware GuestInfo datasource

With this update, the cloud-init utility is able to read the datasource for VMware guestinfo data. As a result, using cloud-init to set up RHEL 9 virtual machines on VMware vSphere is now more efficient and reliable.

RHEL 9 virtual machines are now supported on certain ARM64 hosts on Azure

Virtual machines that use RHEL 9 as the guest operating system are now supported on Microsoft Azure hypervisors running on Ampere Altra ARM-based processors.

cloud-init supports user data on Microsoft Azure

The --user-data option has been introduced for the cloud-init utility. Using this option, you can pass scripts and metadata from the Azure Instance Metadata Service (IMDS) when setting up a RHEL 9 virtual machine on Azure.

New SSH module for cloud-init

With this update, an SSH module has been added to the cloud-init utility, which automatically generates host keys during instance creation.

sos report now offers an estimate mode run

This sos report update adds the --estimate-only option with which you can approximate the disk space required for collecting an sos report from a RHEL server. Running the sos report --estimate-only command:

Podman now supports secure short names

Short-name aliases for images can now be configured in the registries.conf file in the [aliases] table. The short-names modes are:

Changes in the container-tools module

The container-tools module contains the Podman, Buildah, Skopeo, and runc tools. The rolling stream, represented by the container-tools:rhel8 stream in RHEL 8, is named container-tools:latest in RHEL 9. Similarly to RHEL 8, stable versions of container tools are going to be available in numbered streams (for example, 3.0).

The containers-common package is now available

The containers-common package has been added to the container-tools:latest module. The containers-common package contains common configuration files and documentation for the container tools ecosystem, such as Podman, Buildah and Skopeo.

Updating container images with new packages

For instance, to update the registry.access.redhat.com/rhel9 container image with the latest packages, use the following commands:

The container-tools meta-package has been updated

The container-tools RPM meta-package, which contains the Podman, Buildah, Skopeo, and runc tools is now available. This update provides a list of bug fixes and enhancements over the previous version.

The podman-py package is now available

The podman-py package has been added to the container-tools:3.0 stable module stream and the container-tools:latest module. The podman-py package is a library of bindings to use the RESTful API of Podman.

Control groups version 2 is now available

The previous version of control groups, cgroups version 1 (cgroups v1) caused performance problems with a variety of applications. The latest release of control groups, cgroups version 2 (cgroups v2) enables system administrators to limit resources for any application without causing performance problems.

The container-tools meta-package is now available

The container-tools RPM meta-package includes Podman, Buildah, Skopeo, CRIU, Udica, and all required libraries, is available in RHEL 9. The stable streams are not available on RHEL 9. To receive stable access to Podman, Buildah, Skopeo, and others, use the RHEL EUS subscription.

Native overlay file system support in the kernel is now available

The overlay file system support is now available from kernel 5.11. The non-root users will have native overlay performance even when running rootless (as a user). Thus, this enhancement provides better performance to non-root users who wish to use overlayfs without the need for bind mounting.

The NFS storage is now available

You can now use the NFS file system as a backend storage for containers and images if your file system has xattr support.

The container-tools meta-package has been updated

The container-tools meta-package includes Podman, Buildah, Skopeo, CRIU, Udica, and all required libraries. This update provides a list of bug fixes and enhancements over the previous version.

The crun container runtime is now the default

The crun container runtime is now the default runtime. The crun container runtime supports an annotation that allows the container to access the rootless user’s additional groups. This is useful for volume mounting in a directory where setgid is set, or where the user only has group access. Both the crun and runc runtimes fully support cgroup v2.

Control group version 2 is now available

The previous version of control groups, cgroup version 1 (cgroup v1) caused performance problems with a variety of applications. The latest release of control groups, cgroup version 2 (cgroup v2) enables system administrators to limit resources for any application without causing performance problems.

Universal Base Images are now available on Docker Hub

Previously, Universal Base Images were only available from the Red Hat container catalog. With this enhancement, Universal Base Images are also available from Docker Hub as a Verified Publisher image.

The openssl container image is now available

The openssl image provides an openssl command-line tool for using the various functions of the OpenSSL crypto library. Using the OpenSSL library, you can generate private keys, create certificate signing requests (CSRs), and display certificate information.

Netavark network stack is now available

The Netavark stack is a network configuration tool for containers. In RHEL 9, Netavark stack is fully supported and enabled by default.

Podman now supports auto-building and auto-running pods using a YAML file

The podman play kube command automatically builds and runs multiple pods with multiple containers in the pods using a YAML file.

Podman now has ability to source subUID and subGID ranges from IdM

The subUID and subGID ranges can now be managed by IdM. Instead of deploying the same /etc/subuid and /etc/subgid files onto every host, you can now define range in a single central storage. You have to modify the /etc/nsswitch.conf file and add sss to the services map line: services: files sss.