10.0 Release Notes
Release Notes for Red Hat Enterprise Linux 10.0
Abstract
Providing feedback on Red Hat documentation
We appreciate your feedback on our documentation. Let us know how we can improve it.
Submitting feedback through Jira (account required)
- Log in to the Jira website.
- Click Create in the top navigation bar
- Enter a descriptive title in the Summary field.
- Enter your suggestion for improvement in the Description field. Include links to the relevant parts of the documentation.
- Click Create at the bottom of the dialogue.
Chapter 1. Overview
1.1. Major changes in RHEL 10.0
Key highlights for RHEL installer:
- The newly created users will have administrative privileges by default, unless you deselect the option.
- You can now set the required time zone by using new options instead of the time zone map.
- The remote desktop protocol (RDP) for graphical remote access replaces VNC.
Key highlights for RHEL image builder:
-
RHEL image builder
cockpit-composer
package has been deprecated and replaced with the newcockpit-image-builder
plugin. -
Disk images, such as AWS or KVM, do not have a separate
/boot
partition.
For more information, see New features and enhancements - Installer and image creation.
Security
As a Technology Preview, system-wide cryptographic policies (crypto-policies
), the OpenSSL, GnuTLS, and NSS toolkits, and the OpenSSH suite now work with post-quantum (PQ) algorithms.
With the new sudo RHEL system role, you can consistently manage sudo
configuration at scale across your RHEL systems.
RHEL 10 introduces Sequoia PGP tools sq
and sqv
that complement the existing GnuPG tools for managing OpenPGP encryption and signatures.
The OpenSSL TLS toolkit introduces creation of FIPS-compliant PKCS #12 files, the pkcs11-provider
for using hardware tokens, and many additional improvements.
RHEL 10 contains the OpenSSH suite in version 9.9, which provides many fixes and improvements over OpenSSH 8.7, which was provided in RHEL 9.
The SELinux userspace release 3.8 introduces a new option for audit2allow
that provides CIL output mode, Wayland support for the SELinux sandbox, and other improvements.
The Keylime agent component is provided in version 0.2.5, which provides support for Initial Device Identity (IDevID) and Initial Attestation Key (IAK) for device identity and uses TLS 1.3 by default. In addition, the new keylime-policy
tool integrates all management tasks of Keylime policies.
The security compliance offering has evolved substantially compared to RHEL 9 in both the tooling and content. You can still perform all the actions you need to bring your systems close to a compliant state although you might need to use different tools than in previous versions of RHEL.
See New features - Security for more information.
Kernel
This release delivers several important improvements and new features to the kernel. We have expanded graphical capabilities by introducing limited support for virtio-gpu
on IBM Z (s390x
) systems for enhanced virtualization experiences.
To improve usability and deployment, the rteval
utility has been containerized, simplifying its integration into various environments. You can run the rteval
utility with all its runtime dependencies from a container image publicly available through the Quay.io container registry.
A dynamic EFIVARS
pstore backend is now supported. You can switch between supported backends such NVMe
and EFIVARS
without rebooting the system.
The rh_waived
kernel command-line boot parameter is now supported to enable waived features in RHEL. However, waived features are disabled by default in RHEL 10.
Dynamic programming languages, web and database servers
RHEL 10.0 provides the following dynamic programming languages:
- Python 3.12
- Ruby 3.3
- Node.js 22
- Perl 5.40
- PHP 8.3
RHEL 10.0 includes the following version control systems:
- Git 2.45
- Subversion 1.14
The following web servers are distributed with RHEL 10.0:
- Apache HTTP Server 2.4.62
- nginx 1.26
The following proxy caching servers are available:
- Varnish Cache 7.4
- Squid 6.10
RHEL 10.0 offers the following database servers:
- MariaDB 10.11
- MySQL 8.4
- PostgreSQL 16
- Valkey 7.2
See New features - Dynamic programming languages, web and database servers for more information.
Compilers and development tools
System toolchain
The following system toolchain components are available with RHEL 10.0:
- GCC 14.2
- glibc 2.39
- Annobin 12.55
- binutils 2.41
Performance tools and debuggers
The following performance tools and debuggers are available with RHEL 10.0:
- GDB 14.2
- Valgrind 3.23.0
- SystemTap 5.1
- Dyninst 12.3.0
- elfutils 0.192
- libabigail 2.6
Performance monitoring tools
The following performance monitoring tools are available with RHEL 10.0:
- PCP 6.3.0
- Grafana 10.2.6
Compiler toolsets
The following compiler toolsets are available with RHEL 10.0:
- LLVM Toolset 19.1.7
- Rust Toolset 1.84.1
- Go Toolset 1.23
For detailed changes, see New features - Compilers and development tools.
Identity Management
Key highlights for Identity Management:
-
The IdM server functions only partially or not at all. Specifically, you cannot install the
ipa-server-dns
package, and the embedded DNS server cannot be configured using the-setup-dns
option. Until the necessary updates tobind-dyndb-ldap
and other impacted components are completed, the integrated DNS feature remains unavailable.
See Known Issues - Identity Management for more information.
The web console
With the new File browser provided by the cockpit-files
package, you can manage files and directories in the RHEL web console.
See New features - The web console for more information.
Red Hat Enterprise Linux system roles
Notable new features in 10.0 RHEL system roles:
-
With the new RHEL system role
aide
, you can detect unauthorized changes to files, directories, and system binaries. -
With the
systemd
RHEL system role you can now manage user units in addition to system units -
You can use the
ha_cluster
RHEL system role to export thecorosync
configuration of an existing cluster in a format that can be fed back to the role to create the same cluster. -
You can use the
podman
RHEL system role to manage the quadlet units of typePod
. -
The
metrics
RHEL system role now supports Valkey as an alternative to Redis.
See New features and enhancements - Red Hat Enterprise Linux System Roles for more information.
1.2. In-place upgrade
In-place upgrade from RHEL 9 to RHEL 10
The supported in-place upgrade paths currently are:
From RHEL 9.6 to RHEL 10.0 on the following architectures:
- AMD and Intel 64-bit architectures (x86-64-v3)
- The 64-bit ARM architecture (ARMv8.0-A)
- IBM Power Systems, Little Endian (POWER9)
- 64-bit IBM Z (z14)
For more information, see Supported in-place upgrade paths for Red Hat Enterprise Linux.
For instructions on performing an in-place upgrade, see Upgrading from RHEL 9 to RHEL 10.
In-place upgrade from RHEL 8 to RHEL 10
It is not possible to perform an in-place upgrade directly from RHEL 8 to RHEL 10. However, you can perform an in-place upgrade from RHEL 8 to RHEL 9 and then perform a second in-place upgrade to RHEL 10. For more information, see In-place upgrades over multiple RHEL major versions by using Leapp.
1.3. Red Hat Customer Portal Labs
Red Hat Customer Portal Labs is a set of tools in a section of the Customer Portal available at https://access.redhat.com/labs/. The applications in Red Hat Customer Portal Labs can help you improve performance, quickly troubleshoot issues, identify security problems, and quickly deploy and configure complex applications. Some of the most popular applications are:
- Registration Assistant
- Kickstart Generator
- Red Hat Product Certificates
- Red Hat CVE Checker
- Kernel Oops Analyzer
- Red Hat Satellite Upgrade Helper
- JVM Options Configuration Tool
- Load Balancer Configuration Tool
- Ceph Placement Groups (PGs) per Pool Calculator
- Yum Repository Configuration Helper
- Red Hat Out of Memory Analyzer
- Postfix Configuration Helper
- System Unit Generator
- Rsyslog Configuration Helper
1.4. Additional resources
The Red Hat Insights service, which enables you to proactively identify, examine, and resolve known technical issues, is available with all RHEL subscriptions. For instructions on how to install the Red Hat Insights client and register your system to the service, see the Red Hat Insights Get Started page.
Public release notes include links to access the original tracking tickets, but private release notes are not viewable so do not include links.[1]
Chapter 2. Architectures
Red Hat Enterprise Linux 10.0 is distributed with the kernel version 6.12.0, which provides support for the following architectures at the minimum required version (stated in parentheses):
- AMD and Intel 64-bit architectures (x86-64-v3)
- The 64-bit ARM architecture (ARMv8.0-A)
- IBM Power Systems, Little Endian (POWER9)
- 64-bit IBM Z (z14)
Make sure you purchase the appropriate subscription for each architecture.
Chapter 3. Distribution of content in RHEL 10
3.1. Installation
Red Hat Enterprise Linux 10 is installed using ISO images. Two types of ISO image are available for the AMD64, Intel 64-bit, 64-bit ARM, IBM Power Systems, and IBM Z architectures:
Installation ISO: A full installation image that contains the BaseOS and AppStream repositories and allows you to complete the installation without additional repositories. On the Product Downloads page, the
Installation ISO
is referred to asBinary DVD
.NoteThe Installation ISO image is in multiple GB size, and as a result, it might not fit on optical media formats. A USB key or USB hard drive is recommended when using the Installation ISO image to create bootable installation media. You can also use the Image Builder tool to create customized RHEL images. For more information about Image Builder, see the Composing a customized RHEL system image document.
- Boot ISO: A minimal boot ISO image that is used to boot into the installation program. This option requires access to the BaseOS and AppStream repositories to install software packages. The repositories are part of the Installation ISO image. You can also register to Red Hat CDN or Satellite during the installation to use the latest BaseOS and AppStream content from Red Hat CDN or Satellite.
3.2. Repositories
Red Hat Enterprise Linux 10 is distributed through two main repositories:
- BaseOS
- AppStream
Both repositories are required for a basic RHEL installation, and are available with all RHEL subscriptions.
Content in the BaseOS repository is intended to provide the core set of the underlying operating system functionality that provides the foundation for all installations. This content is available in the RPM format and is subject to support terms similar to those in previous releases of RHEL.
Content in the AppStream repository includes additional user-space applications, runtime languages, and databases in support of the varied workloads and use cases.
In addition, the CodeReady Linux Builder repository is available with all RHEL subscriptions. It provides additional packages for use by developers. Packages included in the CodeReady Linux Builder repository are unsupported.
For more information about RHEL 10 repositories and the packages they provide, see the Package manifest.
3.3. Application Streams
Multiple versions of user-space components are delivered as Application Streams and updated more frequently than the core operating system packages. This provides greater flexibility to customize RHEL without impacting the underlying stability of the platform or specific deployments.
Application Streams are available in the following formats:
- RPM format
- Software Collections
- Flatpaks
In previous RHEL major versions, some Application Streams were available as modules as an extension to the RPM format. In RHEL 10, Red Hat does not intend to provide any Application Streams that use modularity as the packaging technology and, therefore, no modular content is being distributed with RHEL 10.
Each Application Stream component has a given life cycle, either the same as RHEL 10 or shorter.
RHEL 10 improves the Application Streams experience by providing initial Application Stream versions that can be installed as RPM packages using the dnf install
command.
Certain initial Application Streams in the RPM format have a shorter life cycle than Red Hat Enterprise Linux 10.
Always determine what version of an Application Stream you want to install.
Content that needs rapid updating, such as alternate compilers and container tools, is available in rolling streams that will not provide alternative versions in parallel.
Chapter 4. Important changes to external kernel parameters
This chapter provides system administrators with a summary of significant changes in the kernel distributed with Red Hat Enterprise Linux 10.0. These changes could include, for example, added or updated proc
entries, sysctl
, and sysfs
default values, boot parameters, kernel configuration options, or any noticeable behavior changes.
New kernel parameters
accept_memory=
[MM]
Values:
lazy
(default)- By default, unaccepted memory is accepted lazily to avoid prolonged boot times. The lazy option adds some runtime overhead until all memory is eventually accepted. In most cases, the overhead is negligible.
eager
-
For some workloads or for debugging purposes, you can use
accept_memory=eager
to accept all memory at once during boot.
arm64.nomops
[ARM64]
Unconditionally disable Memory Copy and Memory Set instructions support.
cgroup_favordynmods=
[KNL]
Enable or disable favordynmods
.
Values:
-
true
-
false
Defaults to the value of CONFIG_CGROUP_FAVOR_DYNMODS
.
early_page_ext
[KNL]
Enforces page_ext
initialization to earlier stages to cover more early boot allocations.
Note that as side effect, some optimizations might be disabled to achieve that: for example, parallelized memory initialization is disabled. Therefore, the boot process might take longer, especially on systems with much memory.
Available with CONFIG_PAGE_EXTENSION=y
.
fw_devlink.sync_state=
[KNL]
When all devices that could probe have finished probing, this parameter controls what to do with devices that have not yet received their sync_state()
calls.
Values:
strict
(default)- Continue waiting on consumers to probe successfully.
timeout
-
Give up waiting on consumers and call
sync_state()
on any devices that have not yet received theirsync_state()
calls afterdeferred_probe_timeout
has expired or bylate_initcall()
ifCONFIG_MODULES
isfalse
.
ia32_emulation=
[X86-64]
Values:
true
-
Allows loading 32-bit programs and executing 32-bit syscalls, essentially overriding
IA32_EMULATION_DEFAULT_DISABLED
at boot time. false
- Unconditionally disables IA32 emulation.
kunit.enable=
[KUNIT]
Enable executing KUnit tests. Requires CONFIG_KUNIT
to be set to be fully enabled.
You can override the default value using KUNIT_DEFAULT_ENABLED
.
The default is 1 (enabled).
mtrr=debug
[X86]
Enable printing debug information related to MTRR registers at boot time.
rcupdate.rcu_cpu_stall_cputime=
[KNL]
Provide statistics on the CPU time and count of interrupts and tasks during the sampling period. For multiple continuous RCU stalls, all sampling periods begin at half of the first RCU stall timeout.
rcupdate.rcu_exp_stall_task_details=
[KNL]
Print stack dumps of any tasks blocking the current expedited RCU grace period during an expedited RCU CPU stall warning.
spec_rstack_overflow=
[X86]
Control RAS overflow mitigation on AMD Zen CPUs.
Values:
off
- Disable mitigation
microcode
- Enable only microcode mitigation.
safe-ret
(default)- Enable software-only safe RET mitigation.
ibpb
- Enable mitigation by issuing IBPB on kernel entry.
ibpb-vmexit
- Issue IBPB only on VMEXIT. This mitigation is specific to cloud environments.
workqueue.unbound_cpus=
[KNL,SMP]
Specify to constrain one or some CPUs to use in unbound workqueues.
Value: A list of CPUs.
By default, all online CPUs are available for unbound workqueues.
Updated kernel parameters
amd_iommu=
[HW, X86-64]
Pass parameters to the AMD IOMMU driver in the system.
Values:
fullflush
-
Deprecated, equivalent to
iommu.strict=1
. off
- Do not initialize any AMD IOMMU found in the system.
force_isolation
-
Force device isolation for all devices. The IOMMU driver is not allowed anymore to lift isolation requirements as needed. This option does not override
iommu=pt
. force_enable
- Force enable the IOMMU on platforms known to be buggy with IOMMU enabled. Use this option with care.
- New:
pgtbl_v1
(default) - Use version 1 page table for DMA-API.
- New:
pgtbl_v2
- Use version 2 page table for DMA-API.
- New:
irtcachedis
- Disable Interrupt Remapping Table (IRT) caching.
nosmt
[KNL, PPC, S390]
Disable symmetric multithreading (SMT). Equivalent to smt=1
.
[KNL, X86, PPC]
Disable symmetric multithreading (SMT).
nosmt=force
-
Force disable SMT. Cannot be undone using the
sysfs
control file.
page_reporting.page_reporting_order=
[KNL]
Minimal page reporting order.
Value: integer.
Adjust the minimal page reporting order.
New: The page reporting is disabled when it exceeds MAX_ORDER
.
tsc=
Disable clocksource stability checks for TSC.
Values:
- [x86]
reliable
- Mark tsc clocksource as reliable. This disables clocksource verification at runtime, and the stability checks done at bootup. Used to enable high-resolution timer mode on older hardware, and in virtualized environment.
- [x86]
noirqtime
-
Do not use TSC to do
irq
accounting. Used to run time disableIRQ_TIME_ACCOUNTING
on any platforms where RDTSC is slow and this accounting might add overhead. - [x86]
unstable
- Mark the TSC clocksource as unstable. This marks the TSC unconditionally unstable at bootup and avoids any further wobbles once the TSC watchdog notices.
- [x86]
nowatchdog
- Disable clocksource watchdog. Used in situations with strict latency requirements, where interruptions from clocksource watchdog are not acceptable.
- [x86]
recalibrate
- Force recalibration against a HW timer (HPET or PM timer) on systems whose TSC frequency was obtained from HW or FW using either an MSR or CPUID(0x15). Warn if the difference is more than 500 ppm.
- New: [x86]
watchdog
Use TSC as the watchdog clocksource with which to check other HW timers (HPET or PM timer), but only on systems where TSC has been deemed trustworthy.
An earlier
tsc=nowatchdog
suppresses this. A latertsc=nowatchdog
overrides this. A console message flags any such suppression or overriding.
usbcore.authorized_default=
[USB]
Default USB device authorization.
Values:
- New:
-1
(default) - Authorized (same as 1).
0
- Not authorized.
1
- Authorized.
2
- Authorized if the device connects to an internal port.
Removed kernel parameters
-
cpu0_hotplug
-
sysfs.deprecated
New sysctl parameters
io_uring_group
Values:
1
-
A process must either be privileged (
CAP_SYS_ADMIN
) or be in theio_uring_group
group to create anio_uring
instance. -1
(default)-
Only processes with the
CAP_SYS_ADMIN
capability can createio_uring
instances.
numa_balancing_promote_rate_limit_MBps
Too high promotion or demotion throughput between different memory types might hurt application latency. You can use this parameter to rate-limit the promotion throughput. The per-node maximum promotion throughput in MB/s is limited to be no more than the set value.
A rule of thumb is to set this to less than 1/10 of the PMEM node write bandwidth.
Updated sysctl parameters
io_uring_disabled
Prevents all processes from creating new io_uring
instances. Enabling this shrinks the attack surface of the kernel.
Values:
- New:
0
-
All processes can create
io_uring
instances as normal. - New:
1
io_uring
creation is disabled for unprivileged processes not in the io_uring_group group.io_uring_setup()
fails with-EPERM
. Existingio_uring
instances can still be used.See the documentation for
io_uring_group
for more information.- New:
2
(default) -
io_uring
creation is disabled for all processes.io_uring_setup()
always fails with-EPERM
. Existingio_uring
instances can still be used.
Chapter 5. Device drivers
5.1. New drivers
Description | Name | Limited to architectures |
---|---|---|
IAA Compression Accelerator Crypto Driver | iaa_crypto | AMD and Intel 64-bit architectures |
Intel® QuickAssist Technology - 0.6.0 | intel_qat | AMD and Intel 64-bit architectures |
Intel® QuickAssist Technology - 0.6.0 | qat_4xxx | AMD and Intel 64-bit architectures |
Intel® QuickAssist Technology - 0.6.0 | qat_c3xxx | AMD and Intel 64-bit architectures |
Intel® QuickAssist Technology - 0.6.0 | qat_c3xxxvf | AMD and Intel 64-bit architectures |
Intel® QuickAssist Technology - 0.6.0 | qat_c62x | AMD and Intel 64-bit architectures |
Intel® QuickAssist Technology - 0.6.0 | qat_c62xvf | AMD and Intel 64-bit architectures |
Intel® QuickAssist Technology - 0.6.0 | qat_dh895xcc | AMD and Intel 64-bit architectures |
Intel® QuickAssist Technology - 0.6.0 | qat_dh895xccvf | AMD and Intel 64-bit architectures |
Description | Name | Limited to architectures |
---|---|---|
bcm-phy-ptp | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures | |
mt7925-common | 64-bit ARM architecture, AMD and Intel 64-bit architectures | |
mt7925e | 64-bit ARM architecture, AMD and Intel 64-bit architectures | |
mt792x-lib | 64-bit ARM architecture, AMD and Intel 64-bit architectures | |
CAN bus driver for Bosch M_CAN controller on PCI bus | m_can_pci | IBM Power Systems, AMD and Intel 64-bit architectures |
CAN bus driver for Bosch M_CAN controller | m_can | IBM Power Systems, AMD and Intel 64-bit architectures |
CAN driver for 8 devices USB2CAN interfaces | usb_8dev | IBM Power Systems, AMD and Intel 64-bit architectures |
CAN driver for EMS Dr. Thomas Wuensche CAN/USB interfaces | ems_usb | IBM Power Systems, AMD and Intel 64-bit architectures |
CAN driver for Kvaser CAN/USB devices | kvaser_usb | IBM Power Systems, AMD and Intel 64-bit architectures |
CAN driver for PEAK-System USB adapters | peak_usb | IBM Power Systems, AMD and Intel 64-bit architectures |
Intel® Infrastructure Data Path Function Linux Driver | idpf | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures |
Marvell 88Q2XXX 100/1000BASE-T1 Automotive Ethernet PHY driver | marvell-88q2xxx | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures |
Marvell Octeon EndPoint NIC Driver | octeon_ep | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures |
Microchip 251x/25625 CAN driver | mcp251x | AMD and Intel 64-bit architectures |
Microchip MCP251xFD Family CAN controller driver | mcp251xfd | AMD and Intel 64-bit architectures |
NXP imx8 DWMAC Specific Glue layer | dwmac-imx | 64-bit ARM architecture |
bcm-phy-ptp | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures | |
Realtek 802.11ax wireless 8852C driver | rtw89_8852c | 64-bit ARM architecture, AMD and Intel 64-bit architectures |
Realtek 802.11ax wireless 8852CE driver | rtw89_8852ce | 64-bit ARM architecture, AMD and Intel 64-bit architectures |
serial line CAN interface | slcan | IBM Power Systems, AMD and Intel 64-bit architectures |
Socket-CAN driver for PEAK PCAN PCIe/M.2 FD family cards | peak_pciefd | IBM Power Systems, AMD and Intel 64-bit architectures |
bcm-phy-ptp | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures | |
mt7925-common | 64-bit ARM architecture, AMD and Intel 64-bit architectures | |
mt7925e | 64-bit ARM architecture, AMD and Intel 64-bit architectures | |
mt792x-lib | 64-bit ARM architecture, AMD and Intel 64-bit architectures |
Description | Name | Limited to architectures |
---|---|---|
AMD HSMP Platform Interface Driver - 2.0 | amd_hsmp | AMD and Intel 64-bit architectures |
AMD Platform Management Framework Driver | amd-pmf | AMD and Intel 64-bit architectures |
Intel TPMI enumeration module | intel_vsec_tpmi | AMD and Intel 64-bit architectures |
Intel TPMI SST Driver | isst_tpmi | AMD and Intel 64-bit architectures |
Intel TPMI UFS Driver | intel-uncore-frequency-tpmi | AMD and Intel 64-bit architectures |
Intel Uncore Frequency Common Module | intel-uncore-frequency-common | AMD and Intel 64-bit architectures |
Intel Uncore Frequency Limits Driver | intel-uncore-frequency | AMD and Intel 64-bit architectures |
Intel WMI Thunderbolt force power driver | intel-wmi-thunderbolt | AMD and Intel 64-bit architectures |
Mellanox PMC driver | mlxbf-pmc | 64-bit ARM architecture |
intel-hid | AMD and Intel 64-bit architectures | |
isst_tpmi_core | AMD and Intel 64-bit architectures |
Description | Name | Limited to architectures |
---|---|---|
AMD XCP Platform Devices | amdxcp | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures |
DRM execution context | drm_exec | |
Range suballocator helper | drm_suballoc_helper | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures |
regmap-ram | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures | |
regmap-raw-ram | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures | |
regmap-ram | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures | |
regmap-raw-ram | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures | |
regmap-ram | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures | |
regmap-raw-ram | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures | |
Arm FF-A interface driver | ffa-module | 64-bit ARM architecture |
NVIDIA BlueField-3 GPIO Driver | gpio-mlxbf3 | 64-bit ARM architecture |
I/O Address Space Management for passthrough devices | iommufd | |
CS42L43 Core Driver | cs42l43 | AMD and Intel 64-bit architectures |
CS42L43 SoundWire Driver | cs42l43-sdw | AMD and Intel 64-bit architectures |
MEI GSC Proxy | mei_gsc_proxy | AMD and Intel 64-bit architectures |
pwrseq_emmc | 64-bit ARM architecture | |
pwrseq_simple | 64-bit ARM architecture | |
SDHCI platform driver for Synopsys DWC MSHC | sdhci-of-dwcmshc | 64-bit ARM architecture |
arm_cspmu_module | 64-bit ARM architecture | |
NVIDIA pinctrl driver | pinctrl-mlxbf3 | 64-bit ARM architecture |
NXP i.MX93 power domain driver | imx93-pd | 64-bit ARM architecture |
Intel RAPL TPMI Driver | intel_rapl_tpmi | AMD and Intel 64-bit architectures |
Mellanox BlueField power driver | pwr-mlxbf | 64-bit ARM architecture |
NXP i.MX93 src driver | imx93-src | 64-bit ARM architecture |
Provide Trusted Security Module attestation reports via configfs | tsm | AMD and Intel 64-bit architectures |
5.2. Updated drivers
Description | Name | Current version | Limited to architectures |
---|---|---|---|
Broadcom MegaRAID SAS Driver | megaraid_sas | 07.727.03.00-rc1 | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures |
Driver for Microchip Smart Family Controller | smartpqi | 2.1.24-046 | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures |
Emulex LightPulse Fibre Channel SCSI driver | lpfc | 0:14.2.0.16 | 64-bit ARM architecture, IBM Power Systems, AMD and Intel 64-bit architectures |
MPI3 Storage Controller Device Driver | mpi3mr | 8.5.0.0.50 |
Chapter 6. New features and enhancements
This version adds the following major new features and enhancements.
6.1. Installer and image creation
bootc-image-builder
now supports creating image mode disk images with advanced partitioning
With this enhancement, the bootc-image-builder
tool gained more options for customizing partitioning. You can use the bootc-image-builder
tool to create disk images of image-mode RHEL with custom mountpoints, including custom mount options, LVM-based partitions and LVM-based SWAP to, for example, change the size of the /
and the /boot
directories by using the config.toml
. As a consequence, you can create disk images with advanced partitioning layout.
Jira:RHELDOCS-18532[1]
RHEL 10 disk images will have predictable network interface names
The net.ifnames=0 will be removed from kernel arguments, causing all systems to use predictable network interface names. As a consequence, from RHEL 10.0 ongoing, disk images created wih RHEL image builder will now have predictable network interface names. There are no plans for backporting this update to older RHEL versions. As a workaround for older versions, remove the kernel argument after the first boot and reboot the system. See Configuring kernel command-line parameters for more details.
Jira:RHELDOCS-18880[1]
New users created in Anaconda are administrators by default
Previously, while creating new users from the installer, the Add administrative privileges to this user account option in graphical installation was deselected. Starting RHEL 10, this option is selected by default. As a result, the newly created users will have administrative privileges in the system by default. You can deselect this option to remove the administrative privileges of the new users, if needed.
Jira:RHELDOCS-18425[1]
Added Kickstart support for CA certificates to enable encrypted DNS configuration during installation
Support for the %certificate
section in the Kickstart file is added to enable the installation of CA certificates into the installer environment and the installed system. This simplifies the setup process and ensures that the encrypted DNS is operational after installation, reducing manual configuration and security gaps. The certificates are inlined in the Base64 ASCII format and imported through the --dir
and --filename
options. This enhancement facilitates encrypted DNS configuration as part of Zero Trust Architecture requirements. The encrypted DNS set up during installation ensures secure DNS resolution from the start, improving security and compliance in automated deployments.
Jira:RHEL-61434[1]
NVMe over Fabrics devices are now available in the RHEL installation program
You can now add NVMe over Fabrics devices to your RHEL installation to extend the benefits of NVMe storage beyond local devices, enabling the same high-performance, low-latency access over a network. In the RHEL installation program, you can select these devices under the NVMe Fabrics Devices section while adding disks on the Installation Destination screen.
Jira:RHELDOCS-18819[1]
Remote Desktop Protocol (RDP) replaces VNC for graphical remote access
The protocol for graphical remote access has been replaced from VNC to remote desktop protocol (RDP), a more robust, and secure graphical remote access. It offers a reliable and encrypted connection, overcoming the limitations of VNC, which lacked encryption support and enforced password length restrictions.
You can now securely connect to graphical installation sessions. As part of this change, the inst.vnc
, inst.vncpassword
, and inst.vncconnect
kernel boot options have been removed and the new options inst.rdp
, inst.rdp.password
, and inst.rdp.username
have been introduced.
RHEL image builder supports creating disk images with advanced partitioning
With this enhancement, RHEL image builderl gained more options for customizing partitioning and creating disk images with advanced partitioning layout. You can create disk images with custom mountpoints, including custom mount options, LVM-based partitions and LVM-based SWAP to, for example, change the size of the /
and the /boot
directories by using a blueprint file.
Jira:RHELDOCS-19584[1]
RHEL image builder supports [customization.installer]
to inject Kickstart files into a built artifact
With this enhancement, you can use the new [customization.installer]
blueprint customization field in RHEL image builder to add your own kickstart file. You can use the customizations for ISO installers such as image installer
or edge installer
, and can choose one of the following options:
- Set all values during the installation process.
-
Enable the
unattended = true
field in Kickstart to get a fully unattended installation. - Inject your own Kickstart by using the Kickstart field.
Depending on the fields that you specify, you can get an unattended installation, or the Installer asks for the required fields. Alternatively, you can choose a fully unattended installation based on predefined configuration defaults. As a result, you gain more flexibility when building ISO images for bare-metal deployments.
Jira:RHELDOCS-19583[1]
bootc-image-builder
now supports creating image mode disk images with advanced partitioning
With this enhancement, the bootc-image-builder
tool gained more options for customizing partitioning and creating disk images with advanced partitioning layout. You can use the bootc-image-builder
tool to create disk images of image-mode RHEL with custom mountpoints, including custom mount options, LVM-based partitions and LVM-based SWAP to, for example, change the size of the /
and the /boot
directories by using the config.toml
.
Jira:RHELDOCS-19291[1]
A new cockpit-image-builder
plugin for RHEL image builder
For RHEL 10, RHEL image builder has a new user interface. As a result, you can benefit from new customization options, integrations with Insights services, and compatibility to share blueprints between RHEL image builder and Insights image builder.
Jira:RHELDOCS-20166[1]
RHEL disk images have the same default locale and timezone
Previously, RHEL disk images had inconsistent default locales and timezones sets. With this enhancement, RHEL disk images have the same locale and timezones by default, that is, the default locale is C.UTF-8
is, and the default timezone is UTC.
Jira:RHELDOCS-20168[1]
Ability to build RHEL images on AWS with UEFI by default
Previously, you could only boot RHEL images on AWS by using legacy BIOS boot. With this enhancement, you can now boot RHEL images on AWS with UEFI by default. As a result, Secure Boot now improves security of your workloads.
Jira:RHELDOCS-20169[1]
RHEL 10 disk images no longer have a separate /boot
partition
RHEL 10 Public disk images, such as AWS images, or KVM images, for example, do not have a separate /boot
partition. In RHEL images, the /boot/
partition removal targets confidential computing.
This change prevents the /boot
partition from exceeding disk space, which was often the case when /boot
was on a separate partition. As a result, operational failures are less likely to occur.
Jira:RHELDOCS-18902[1]
RHEL image builder now supports blueprint customization to implement advanced partitioning
With this enhancement, you can customize your blueprint to implement advanced partitioning for the images that you create by using RHEL image builder images. As a result, you have disk images with custom mountpoints, including custom mount options, LVM-based partitions and LVM-based SWAP to, for example, change the size of the /
and the /boot
directories by using a blueprint customization.
Jira:RHELDOCS-19106[1]
6.2. Security
keylime-agent-rust
provided in version 0.2.5
The keylime-agent-rust
package, which contains the Keylime agent, is provided in version 0.2.5 in RHEL 10. This version offers important enhancements and bug fixes, most importantly the following:
Added support for Initial Device Identity (IDevID) and Initial Attestation Key (IAK) for device identity. The following configuration options have been added:
enable_iak_idevid
-
(default:
false
) Enables the use of IDevID and IAK certificates to identify the device. iak_idevid_template
-
(default:
detect
) Specifies the template that sets the algorithms to be used for IDevID and IAK (defined in TPM 2.0 Keys for Identity and Attestation, section 7.3.4). Thedetect
keyword sets the template according to the algorithms used in the configured certificates. iak_idevid_name_alg
-
(default:
sha256
) Specifies the digest algorithm used in IDevID and IAK. Used only if theiak_idevid_template
option is not set asdetect
. iak_idevid_asymmetric_alg
-
(default:
rsa
) Specifies the signing algorithm used in IDevID and IAK. Used only if theiak_idevid_template
option is not set asdetect
. iak_cert
-
(default:
default
) Specifies the path to the file that contains the X509 IAK certificate. The default path is/var/lib/keylime/iak-cert.crt
. idevid_cert
-
(default:
default
) Specifies the path to the file that contains the X509 IDevID certificate. The default path is/var/lib/keylime/idevid-cert.crt
.
-
Configurable IMA and measured boot event log locations are supported by using the new
ima_ml_path
andmeasuredboot_ml_path
configuration options. - Local DNS name, local IP, and configured contact IP are included as part of the Subject Alternative Name of the generated self-signed X509 certificate.
-
IPv6 addresses with or without brackets are supported in the
registrar_ip
configuration option. -
Hexadecimal encoded values are supported in the
tpm_ownerpassword
configuration option. - TLS 1.3 is enabled in connections to the agent.
libreswan
provided in version 4.15
The libreswan
packages are provided in version 4.15 in RHEL 10. This version offers substantial improvements over the previous version 4.12 that was provided in previous releases:
-
Removed a dependency on
libxz
throughlibsystemd
. -
In IKEv1, default proposals have been set to
aes-sha1
for Encapsulating Security Payload (ESP) andsha1
for Authentication Header (AH). - IKEv1 rejects ESP proposals that combine Authenticated Encryption with Associated Data (AEAD) and non-empty INTEG.
- IKEv1 rejects exchange when a connection has no proposals.
IKEv1 has a more limited default cryptosuite:
IKE={AES_CBC,3DES_CBC}-{HMAC_SHA2_256,HMAC_SHA2_512HMAC_SHA1}-{MODP2048,MODP1536,DH19,DH31} ESP={AES_CBC,3DES_CBC}-{HMAC_SHA1_96,HMAC_SHA2_512_256,HMAC_SHA2_256_128}-{AES_GCM_16_128,AES_GCM_16_256} AH=HMAC_SHA1_96+HMAC_SHA2_512_256+HMAC_SHA2_256_128
IKE={AES_CBC,3DES_CBC}-{HMAC_SHA2_256,HMAC_SHA2_512HMAC_SHA1}-{MODP2048,MODP1536,DH19,DH31} ESP={AES_CBC,3DES_CBC}-{HMAC_SHA1_96,HMAC_SHA2_512_256,HMAC_SHA2_256_128}-{AES_GCM_16_128,AES_GCM_16_256} AH=HMAC_SHA1_96+HMAC_SHA2_512_256+HMAC_SHA2_256_128
Copy to Clipboard Copied! -
Failures of the
libcap-ng
library are no longer fatal. -
TFC padding is set for AEAD algorithms in the
pluto
utility.
Jira:RHEL-52935[1]
Libreswan is faster in adding large numbers of connections
Before this update, it took around 30 minutes for the libreswan
IPsec implementation to add 1,000 connections in certain circumstances. The latest version of libreswan
skips the getservbyname()
function on numbered connections, and offloading validation of existing connections to the pluto
daemon substantially reduces the loading times for large configuration files. As a result, the time to add 1,000 connections should be about 50 seconds instead of 30 minutes on the same configuration.
Jira:RHEL-74850[1]
GnuTLS provided in version 3.8.9
RHEL 10 provides the gnutls
packages in version 3.8.9. Among other improvements, this version contains the following security-related changes that are not compatible with earlier versions:
- GnuTLS now checks all records in an Online Certificate Status Protocol (OCSP) response. Before this update, when multiple records were provided in a single OCSP response, only the first record was checked. This version of GnuTLS examines all records until the server certificate matches.
- The minimum RSA key size for verification to be approved in FIPS mode has been increased to 2048 bits.
Jira:RHEL-69524[1]
OpenSSH provided in version 9.9
RHEL 10 provides OpenSSH in version 9.9, which introduces many fixes and improvements over OpenSSH 8.7 which was provided in RHEL 9. For the complete list of changes, see the openssh-9.9p1/ChangeLog
file. The most important changes are as follows:
-
A system for restricting forwarding and use of keys that were added to the
ssh-agent
program has been added tossh
,sshd
,ssh-add
, andssh-agent
programs. Improvements to the use of the FIDO standard:
-
The
verify-required
certificate option has been added tossh-keygen
. - Fixes to FIDO key handling reduce unnecessary PIN prompts for keys that support intrinsic user verification.
-
A check for existing matching credentials in the
ssh-keygen
program prompts the user before overwriting the credential.
-
The
-
New
EnableEscapeCommandline
option in thessh_config
configuration file enables the command line option in theEscapeChar
menu for interactive sessions. -
New
ChannelTimeout
keyword specifies whether and how quickly thesshd
daemon should close inactive channels. -
The
ssh-keygen
utility generates Ed25519 keys by default except in FIPS mode, where the default is RSA. -
The
ssh
client performs keystroke timing obfuscation by sending interactive traffic at fixed intervals, every 20 ms by default, when only a small amount of data is being sent. It also sends fake keystrokes for a random interval after the last real keystroke, defined by theObscureKeystrokeTiming
keyword. - Support for DSA keys has been removed.
-
The
pam-ssh-agent
subcomponent has been removed. -
The
ssh-keysign
tool is now in a separate subpackage. -
With the new
ChannelTimeout
type,ssh
andsshd
close all open channels if all channels lack traffic for a specified interval. This is in addition to the existing per-channel timeouts. -
The
sshd
server blocks client addresses that repeatedly fail authentication, repeatedly connect without ever completing authentication, or that crash the server. -
The
sshd
server penalizes client addresses that do not successfully complete authentication. The penalties are controlled by the newPerSourcePenalties
keyword insshd_config
. -
The
sshd
server is split into a listener binarysshd
and a per-session binarysshd-session
. This reduces the listener binary size that does not need to support the SSH protocol. This also removes support for disabling privilege separation and disabling re-execution ofsshd
-
In portable OpenSSH,
sshd
no longer usesargv[0]
as the PAM service name. You can select the service name at runtime with the newPAMServiceName
directive in thesshd_config
file. This defaults to "sshd". -
The
HostkeyAlgorithms
keyword allowsssh
to disable implicit fallback from certificate host key to plain host keys. - The components have been hardened in general and work better with the PKCS #11 standard.
- As a Technology Preview, OpenSSH supports post-quantum cryptography (PQC).
Added custom configuration for pkcs11-provider
The pkcs11-provider
allows direct access to hardware tokens by using pkcs11
URIs from OpenSSL programs. Upon installation, the pkcs11-provider
is automatically enabled and loads tokens detected by the pcscd
daemon by using the p11-kit
driver by default. As a result, you can use tokens available to the system if you provide a key URI by using the pkcs11
URI specification to an application that supports that format by installing the package without the need to further change OpenSSL configuration. Uninstalling the package also removes the OpenSSL configuration snippet, which prevents errors when OpenSSL parses the configuration files.
File context equivalency set to /var/run = /run
in the SELinux policy
The previous /run = /var/run
file context equivalency is now inverted to /var/run = /run
and the SELinux policy sources have been updated accordingly. The equivalency has been inverted to match the actual filesystem state and to prevent some userspace tools from reporting an error. This change should not be visible from the user or administrator perspective. If you have any custom modules that contain file specification for files in /var/run
, change them to /run
.
Jira:RHEL-36094[1]
OpenSSL uses pkcs11-provider
for hardware tokens
Because OpenSSL 3.0 deprecated engines and replaced them with providers, RHEL 10 replaces the openssl-pkcs11
engine with the pkcs11-provider
. This allows OpenSSL to use hardware tokens in applications such as apache
HTTPD, libssh
, bind
, and other applications that are linked with OpenSSL and use asymmetric private keys stored in an HSM, smartcard or other tokens with a PKCS #11 driver available.
New capability.conf(5)
man page
The capability.conf(5)
man page has been added. It provides descriptions for the capability.conf
configuration file and the pam_cap.so
module arguments.
libkcapi
provided in version 1.5.0
In RHEL 10.0, the libkcapi
packages are provided in upstream version 1.5.0. This version provides various bug fixes, optimizations and enhancements, most notably:
-
The
sha*
applications have been removed and replaced with a single application calledkcapi-hasher
. Symlinks tokcapi-hasher
with equivalent names as the originalsha*
applications have been added into thebin
andlibexec
directories. This change does not cause any known regressions. -
The
sha3sum
command, which prints checksums of files that use SHA-3, has been added. -
The
kcapi_md_sha3_*
wrapper APIs have been added.
Jira:RHEL-50457[1]
Stricter SSH host key permissions have been restored
The necessary host key permissions have been changed from the previous less strict value of 0640
to 0600
, which is also the value used upstream. The ssh_keys
group, which previously owned all SSH keys, has also been removed. Therefore, the ssh-keysign
utility uses the SUID bit instead of the SGID bit.
Jira:RHEL-59102[1]
libssh
provided in version 0.11.1
The libssh
SSH library is provided in version 0.11.1, which brings new functionalities, most importantly the following:
- Better asynchronous SFTP IO
- PKCS #11 provider support for OpenSSL 3.0
- Testing for GSSAPI authentication
- Proxy jump
p11-kit
provided in version 0.25.5
The p11-kit
packages are provided in version 0.25.5 in RHEL 10. This version provides enhancements and fixes over the previous version, most importantly, the following:
-
Support for recursive attributes has been added to the
p11-kit
RPC protocol. - A function to check run-time version of the library has been added.
- Version information is no longer accessible through macros.
-
With the new
--id
option, you can assign an ID to key pairs generated with thegenerate-keypair
command or imported with theimport-object
command. -
With the new
--provider
option, you can specify a PKCS #11 module when usingp11-kit
commands. -
Fixed a bug in
p11-kit
where the EdDSA mechanism was not recognized ingenerate-keypair
. -
p11-kit
falls back to theC_GetFunctionList
function when theC_GetInterface
function is not supported.
Jira:RHEL-46898[1]
pkeyutil
now supports encapsulation and decapsulation
The pkeyutil
OpenSSL subcommand supports performing encapsulation and decapsulation cryptographic operations. The new post-quantum cryptographic (PQC) algorithm ML-KEM (FIPS 203) permits only encapsulation and decapsulation operations, and you can now use algorithms such as RSASVE and ML-KEM through pkeyutil
.
GnuTLS can use certificate compression
GnuTLS compresses client and server certificates with the zlib
, brotli
or zstd
compression method according to RFC 8879 if both client and server support and enable it. This method reduces data usage, and should otherwise be unnoticeable to users.
Jira:RHEL-42514[1]
New no-atexit
option in OpenSSL
OpenSSL is now built with the no-atexit
option, so that the OPENSSL_cleanup
function is no longer registered as an atexit
handler. Using this option might cause the valgrind
debugging tool to report one-time memory leaks of the resources allocated on OpenSSL startup.
setools
provided in version 4.5.0
The setools
packages are provided in version 4.5.0 in RHEL 10. This version provides bug fixes and enhancements, most notably the following:
-
Graphical results for information flow analysis and domain transition analysis have been added to the
apol
,sedta
, andseinfoflow
tools. -
Tooltips and detail popups in
apol
have been added to help cross-referencing query and analyzing results along with context-sensitive help.
RHEL 10 provides NSS in version 3.101
The NSS cryptographic toolkit packages are provided in version 3.101 in RHEL 10, which provides many bug fixes and enhancements. The most notable changes are the following:
- DTLS 1.3 protocol is now supported (RFC 9147).
- PBMAC1 support has been added to PKCS #12 (RFC 9579).
-
Experimental support for X25519Kyber768Draft00 hybrid post-quantum key agreement has been added (
draft-tls-westerbaan-xyber768d00
). It will be removed in a future release. -
lib::pkix
is the default validator in RHEL 10. - RSA certificates with keys shorter than 2048 bits stop working in SSL servers, in accordance with the system-wide cryptographic policy.
OpenSSL can create FIPS-compliant PKCS #12 files
The OpenSSL secure communication suite has been updated and can now create PKCS #12 files in accordance with the RFC 9579 document.
gnutls
provided in version 3.8.7
In RHEL 10.0, the gnutls
library package is provided in upstream version 3.8.7. This version provides various bug fixes, optimizations and enhancements, most notably:
- Certificate compression in TLS is supported (RFC 8879).
- Optimal Asymmetric Encryption Padding scheme (RSA-OAEP) is supported (RFC 8017).
- API for incremental calculation of SHAKE hashes of arbitrary length across multiple calls has been added.
- RSA encryption and decryption with PKCS #1 v1.5 padding is deprecated and disallowed by default.
-
In FIPS mode,
gnutls
now defaults to exporting PKCS #12 files with Password-Based Message Authentication Code 1 (PBMAC1) as defined in RFC 9579. If you need interoperability with systems running in FIPS mode, use PBMAC1 explicitly.
Jira:RHEL-50011[1]
The DEFAULT
cryptographic policy uses additional scopes
The crypto-policies
package now offers additional scopes @pkcs12
, @pkcs12-legacy
, @smime
, and @smime-legacy
, and uses them in the DEFAULT
system-wide cryptographic policy. The selection of cryptographic algorithms used for PKCS #12 and S/MIME when network security services (NSS) is the underlying cryptographic library now follows system-wide cryptographic policies. Therefore, you can more easily select algorithms with higher granularity by using custom policies and subpolicies. The scopes use the following ciphers, hashes, and key exchanges:
cipher@pkcs12 = AES-256-CBC AES-128-CBC cipher@pkcs12-import = 3DES-CBC+ RC2-CBC+ cipher@smime = AES-256-CBC AES-128-CBC 3DES-CBC cipher@smime-import = RC2-CBC+ hash@{pkcs12,smime} = SHA2-256 SHA2-384 SHA2-512 SHA3-256 SHA3-384 SHA3-512 \ SHA2-224 SHA3-224 hash@{pkcs12-import,smime} = SHA1+ key_exchange@smime = RSA DH ECDH
cipher@pkcs12 = AES-256-CBC AES-128-CBC
cipher@pkcs12-import = 3DES-CBC+ RC2-CBC+
cipher@smime = AES-256-CBC AES-128-CBC 3DES-CBC
cipher@smime-import = RC2-CBC+
hash@{pkcs12,smime} = SHA2-256 SHA2-384 SHA2-512 SHA3-256 SHA3-384 SHA3-512 \
SHA2-224 SHA3-224
hash@{pkcs12-import,smime} = SHA1+
key_exchange@smime = RSA DH ECDH
The LEGACY
cryptographic policy uses a less strict selection of ciphers, hashes, and key exchanges than the DEFAULT
policy, whereas the FUTURE
policy is stricter. As a result, you can customize the algorithms used in NSS for importing and exporting PKCS #12 files and S/MIME encryption and decryption. NSS is currently the only cryptographic library linked to the newly offered scopes.
OpenSSH in FIPS mode generates RSA keys by default
In previous versions, the ssh-keygen
utility in OpenSSH generated RSA keys by default. In the versions provided with RHEL 10, ssh-keygen
generates ed25519 keys by default in non-FIPS mode and RSA keys by default in FIPS mode.
NSS creates FIPS-compliant PKCS #12 in FIPS mode
PKCS #12 uses an ad-hoc mechanism for integrity checks. Since the publication of PKCS #12 version 1.1, more rigorous methods of integrity checks have been created in PKCS #5 Version 2.0: the password-based message authentication code 1 (PBMAC1). This update adds PBMAC1 support in PKCS #12 files to Network Security Services (NSS) in accordance with the RFC 9579 document. As a result, NSS can now read any .p12
file that uses RFC 9579 and can generate RFC-9579-compliant message authentication codes (MAC) when requested by the user. For compatibility, NSS generates old MACs by default when not in FIPS mode. For more information on generating new MACs, see the pk12util(1)
man page on your system.
OpenSC provided in version 0.26.1
RHEL 10 provides the opensc
packages in the upstream version 0.26.1. The most notable enhancements and bug fixes are:
- Additional fixes for removing the time side-channel leakage related to the RSA PKCS #1 v1.5 padding removal after decryption
- Unified OpenSSL logging
-
Support for the HKDF, RSA OEAP encryption, AES GCM, and AES GMAC mechanisms in the
pkcs11-tool
utility - Fixes for CVEs targeting uninitialized memory problems: CVE-2024-45615, CVE-2024-45616, CVE-2024-45617, CVE-2024-45618, CVE-2024-45619, and CVE-2024-45620
- A fix of allocations of aligned memory that caused crashes in the Chromium web browser
- A fix of reading certificates in the TeleSec Chipcard Operating System (TCOS) card driver
OpenSC packages split into opensc
and opensc-lib
In RHEL 10, the opensc
packages have been split into the opensc
and opensc-lib
subpackages to enable support for smart cards in Flatpak applications.
New package: tpm2-openssl
RHEL 10 includes the new tpm2-openssl
package, which contains the TPM2 provider for the OpenSSL TLS toolkit. The TPM2 provider enables using cryptographic keys from a Trusted Platform Module (TPM) 2.0 chip through the OpenSSL API.
Jira:RHEL-30799[1]
Rule-based filtering and forwarding of Audit events
With the new audisp-filter
plugin, you can suppress specific Audit events based on custom ausearch
expressions in a flexible way, which should reduce unnecessary output to downstream plugins.
This plugin acts as a bridge between Audit and other plugins. It filters out certain Audit events and forwards only those events that correspond to the rules specified in the configuration file.
As a result, you can selectively filter Audit events by using allowlist or blocklist modes. Each plugin that uses the audisp-filter
can define its own configuration file that contains matching rules. One common use case is to exclude noisy or irrelevant Audit events and forward only significant events to the syslog plugin. This allows the filtered events to be logged by syslog, making Audit logs more manageable.
Additional services confined in the SELinux policy
This update adds additional rules to the SELinux policy that confine the following systemd
services:
-
iio-sensor-proxy
-
samba-bgqd
-
tlshd
-
gnome-remote-desktop
-
pcm-sensor-server
As a result, these services no longer run with the unconfined_service_t
SELinux label, which violated the CIS Server Level 2 benchmark "Ensure No Daemons are Unconfined by SELinux" rule, and run successfully in SELinux enforcing mode.
The selinux-policy
Git repository for Centos Stream 10 is now publicly accessible
CentOS Stream contributors now can participate in the development of the SELinux policy by contributing to the c10s
branch of the fedora-selinux/selinux-policy
Git repository. These contributions can then be used to improve the SELinux policy of RHEL 10.
setroubleshoot
provided in version 3.3.35
The setroubleshoot
packages are provided in version 3.3.35 in RHEL 10. This version provides various fixes and enhancements, most importantly the following:
- Backtrace on CoreOS has been fixed.
- Broken AppStream metadata have been updated.
- The paths of used icons have been fixed to recently updated paths.
Rules for additional libvirt
services added to the SELinux policy
The following SELinux types related to the libvirt
services have been added to the SELinux policy:
-
virt_dbus_t
-
virt_hook_unconfined_t
-
virt_qmf_t
-
virtinterfaced_t
-
virtnetworkd_t
-
virtnodedevd_t
-
virtnwfilterd_t
-
virtproxyd_t
-
virtqemud_t
-
virtsecretd_t
-
virtstoraged_t
-
virtvboxd_t
-
virtvzd_t
-
virtxend_t
SELinux policy modules related to EPEL packages moved to selinux-policy-epel
The SELinux policy modules related only to packages contained in the Extra Packages for Enterprise Linux (EPEL) repository and not to any RHEL package were moved from the selinux-policy
package to the new selinux-policy-epel
package. As a result, selinux-policy
is smaller, and the system performs operations such as rebuilding and loading the SELinux policy faster.
SELinux userspace provided in version 3.8
RHEL 10 contains the SELinux user-space components in version 3.8. This version introduces enhancements and fixes over the previous version, most importantly, the following:
-
A new
audit2allow -C
option has been added to the CIL output mode. -
The
semanage
utility allows modifying records onadd
. -
The
semanage
utility no longer sorts localfcontext
definitions. -
The
checkpolicy
program supports the CIDR notation fornodecon
statements. -
The SELinux
sandbox
utility supports the Wayland display protocol. - File context and ownership in the policy store are preserved during SELinux policy rebuild.
-
The format of the binary
file_contexts.bin
file has been changed, and files that use the old format are ignored. The new format is optimized and not architecture-dependent. You can create the binaryfile_contexts.bin
file in the new format by rebuilding the SELinux policy. -
The performance of the
selabel_lookup
library call has been improved significantly.
Rsyslog is provided in version 8.2412.0
The rsyslog
packages are provided in version 8.2412.0 in RHEL 10.0. Among other fixes and enhancements, you can bind a ruleset to the imjournal
module. With this optimization, log messages can be filtered and processed at the input stage, which reduces the load on the main message queue. By minimizing resource utilization, this feature ensures smoother handling of high-volume logs.
Jira:RHEL-70110[1]
Clevis provided in version 21 with support for PKCS #11
RHEL 10 provides the clevis
packages in version 21. This version contains many enhancements and bug fixes, notably:
-
Added the
clevis-pin-pkcs11
subpackage which provides thepkcs11
pin for unlocking LUKS-encrypted volumes using a PKCS #11 device (smart card). -
Added two checks to the
clevis-udisks2
subpackage. - Added a fix that prevents "Address in use" errors.
jose
provided in version 14
The jose
package is provided in version 14 in RHEL 10. The jose
utility is a C-language implementation of the Javascript Object Signing and Encryption (JOSE) standards. The most important enhancements and fixes include the following:
-
Improved bound checks for the
len
function for theoct
JWK Type in OpenSSL, as a fix to an error reported by the SAST (Static Application Security Testing) process. -
The protected JSON Web Encryption (JWE) headers no longer contain
zip
. -
The
jose
utility avoids potential denial of service (DoS) attacks by using high decompression chunks.
Keylime provided in version 7.12
RHEL 10 provides Keylime in version 7.12, which provides important fixes and enhancements, most importantly:
-
The new
keylime-policy
tool integrates all management tasks of Keylime runtime policies and measured boot policies and improves the performance of generating policies. -
The
verifier
andtenant
Keylime components no longer require payloads for theagent
component.
Libreswan provided in version 5.2
In RHEL 10, Libreswan is provided in upstream version 5.2. This version provides many bug fixes and enhancements, most importantly the following:
-
Duplicate
--ctlsocket
option for thewhack
command is fixed (RHEL-75605). - An expectation failure with crossing streams is fixed (RHEL-73236).
- Parsing protoport configuration has been optimized (RHEL-74850).
-
Incorrect outputs for the
ipsec showhostkey
command are fixed (RHEL-75975). -
Crashes on executing
ipsec --rereadsecrets
are fixed (RHEL-69403). -
The
keyingtries
anddpd*
options are ignored. -
The
ipsec-interface-managed=no
option for network namespaces has been introduced. Linux-specific updates:
- Added support for packet offload counters in Linux kernel 6.7 and above.
- Implemented IP-TFS (IP Traffic Flow Security) support as per RFC 9347.
- Ensured compatibility with Linux kernel 6.10+ by setting the replay window to 0 on outbound SAs.
-
Fixed issues related to the
nopmtudisc
setting on inbound security associations (SA). IKEv2 enhancements: - Introduced support for RFC 5723 IKE Session Resumption, enabling session resumption without re-authentication.
-
Added support for
draft-ietf-ipsecme-ikev2-qr-alt-04
, enhancing key exchange mechanisms. - Implemented PPK (Post-quantum Pre-shared Key) in the INTERMEDIATE exchange to improve security.
- NOTE
-
Peer authentication that uses PKCS #1 1.5 RSA with SHA-1 requires explicit allowing of SHA-1 signatures in NSS by using a custom cryptographic policies subpolicy. This is necessary when
authby=rsa-sha1
is configured or in a default configuration when an authenticated peer does not support RFC 7427.
ssh
now provides a link with additional details about SSH login error messages
In case of an early error, the ssh
command-line tool provides a link to the Red Hat Customer Portal page that contains additional details about common error messages and steps for resolving them. This helps troubleshoot SSH login problems when you use interactive mode.
Jira:RHEL-62718[1]
nettle
provided in version 3.10.1
RHEL 10 contains the nettle
library package in version 3.10.1. This version provides various bug fixes, optimizations and enhancements, most notably:
- SHA-256 hashing, AES-GCM encryption, and AES decryption in general have gained optimizations on 64-bit PowerPC.
- DRBG-CTR-AES256, a new deterministic random bit generator, has been added.
- SHAKE-128, an arbitrary length hash function of the SHA-3 family, has been added.
- Support for the RSA-OAEP scheme has been added.
- Incremental interface for SHAKE hashing algorithms has been added.
Jira:RHEL-79116[1]
OpenSCAP rebased to 1.3.12
The OpenSCAP packages have been rebased to upstream version 1.3.12. This version provides bug fixes and various enhancements. For additional information, see the OpenSCAP release notes.
SCAP Security Guide provided in 0.1.76
For details, see the SCAP Security Guide release notes.
6.3. RHEL for Edge
RHEL provides the greenboot
package in version 0.15.8
The greenboot
packages have been updated to version 0.15.8, which provides bug fixes and enhancements. Notable changes include:
-
Fixed the
bootc
compatibility withrpm-ostree
whenbootc
is available alongsiderpm-ostree
. -
General bug fix: If
bootc
is not available, rollback usingrpm-ostree
.
6.4. Subscription management
Ability to control feature enablement during rhc connect
using CLI options for better control
With the enhanced rhc connect
command, you can now enable or disable specific features by using the --enable-feature
and --disable-feature
CLI options. By default, the following features are enabled:
- Content: Provides access to Red Hat CDN repositories.
- Analytics: Triggers system registration with Red Hat Insights.
-
Remote-management: Starts the
yggdrasil.service
.
Additionally, feature dependencies are enforced to prevent invalid configurations. When using --format json
, the output now includes feature enablement details, improving automation and visibility.
Jira:RHEL-65517[1]
The subscription-manager status
command describes only the registration status
Previously, the output of the subscription-manager status
command in Simple Content Access (SCA) mode included several details such as the compliance status. With this enhancement, the output of the subscription-manager status
command has been simplified to state only the registration status.
Jira:RHEL-78003[1]
6.5. Software management
The repository metadata is now not downloaded by default
Previously, when you downloaded a repository’s metadata, the filelists metadata was downloaded by default. The filelists metadata is large and is typically not needed. With this update, this metadata is not downloaded by default, which improves responsiveness and saves disk space. The filelists metadata is also no longer downloaded or updated from repositories and is not loaded into the DNF transaction when you run a dnf
command. If the dnf
command requires the filelists metadata or includes a file-related argument, the metadata is loaded automatically.
When a package has a filepath dependency that requires filelists metadata to be resolved, the transaction fails with a dependency resolution error and the following hint:
(try to add '--skip-broken' to skip uninstallable packages or '--setopt=optional_metadata_types=filelists' to load additional filelists metadata)
(try to add '--skip-broken' to skip uninstallable packages or '--setopt=optional_metadata_types=filelists' to load additional filelists metadata)
If you want to re-enable the default filelist metadata downloading, you can add the filelists
value to the optional_metadata_types
option in the /etc/dnf/dnf.conf
configuration file.
Jira:RHEL-12355[1]
DNF now uses librpmio
for processing PGP keys
To verify RPM package signatures, RPM uses the rpm-sequoia
library instead of the previously-used custom PGP parser. With this update, the librepo
library, which can verify PGP signatures on DNF repositories, now also uses rpm-sequoia
through the librpmio
library. As a result, to provide consistent user experience, the dnf
, librpm
, and rpm
components now use the same PGP implementation.
dnf-plugins-core
provided in version 4.7.0
RHEL 10 provides the dnf-plugins-core
package in version 4.7.0 that includes a new python3-dnf-plugin-pre-transaction-actions
package. This package includes a new pre-transaction-actions
DNF plug-in that allows you to execute a command upon starting an RPM transaction. For more information, see the dnf-pre-transaction-actions(8)
manual page on your system.
createrepo_c
provided in version 1.0.0
RHEL 10 provides the createrepo_c
package in version 1.0.0. Notable changes over the previous version include:
-
Default compression switched from
gz
tozstd
, which provides smaller metadata that is faster to decompress. Note that thegz
compression is still supported. -
To save time and disk space, metadata in the SQLite database format is no longer generated by default. Note that you can still create this metadata by using the
--database
switch or thesqliterepo_c
tool. Managing the
group.xml
metadata has been standardized. Previously, this metadata was present twice, as compressed and uncompressed. With this update, the group metadata is present only once as compressed and has thegroup
metadata type.NoteThe
group.xml
metadata is not compatible with YUM in RHEL 7. If required, you can still create repositories with the old layout by using themodifyrepo_c
command.
Jira:RHELDOCS-18997[1]
DNF, PackageKit, and microdnf
tools now install only newly recommended packages during an upgrade
The exclude_from_weak_autodetect
option can autodetect unmet weak dependencies of installed packages and block installation of packages that satisfy already unmet dependencies. Before this update, this option was set to False
by default. Consequently, all existing weak dependencies of a package were installed when upgrading that package, even if some weak dependencies were not previously installed. With this update, the default value for the exclude_from_weak_autodetect
option has been set to true
. As a result, only newly recommended packages are now installed during an upgrade with the DNF, PackageKit, or microdnf
tools.
You can manually change the default value of exclude_from_weak_autodetect
in the /etc/dnf/dnf.conf
configuration file.
Jira:RHELDOCS-19415[1]
The RPM database relocated to /usr
With this update, the RPM database has been moved from the /var/lib/rpm
directory to the /usr/lib/sysimage/rpm
directory. Storing the database in /usr
simplifies the creation and rollback of system snapshots because the contents of /var
no longer have to be considered. It also aligns RHEL with rpm-ostree
based systems, such as RHEL CoreOS, which already store the RPM database under the /usr
directory.
This change has no visible effect on the majority of users because RPM has not changed in its functionality. However, advanced users who perform OS-level snapshots, which usually include the /usr
directory, no longer have to include the RPM database located in /var/lib/rpm
in the snapshot to preserve the system state upon rollback.
Jira:RHELDOCS-19417[1]
A new --exclude-services
flag to exclude systemd
services from the list of stale processes
You can use the dnf needs-restarting --services
to list systemd
services that need restarting. With this update, a new --exclude-services
flag has been added to dnf needs-restarting
. You can use this flag to exclude systemd
services from the list of stale processes.
Image mode for RHEL users can now use dnf --transient
to perform package transactions that reset on reboot
Previously, Image mode for RHEL users could transiently install, remove, and upgrade packages by running the bootc usr-overlay
command to unlock the system and then make changes by running DNF commands. If you use bootc usr-overlay
, when the system reboots, the /usr
directory overlay disappears and all changes made to it will reset. Changes to other directories, including configuration in /etc
and program state in /var
, persist across reboots.
With this update, a new --transient
flag and a new persistence
configuration option have been added to DNF to improve the user experience on bootc systems. You can now skip the bootc usr-overlay
step by using either of the following options:
-
Use the
dnf --transient
command. -
Set the
persistence
option totransient
in thednf.conf
file.
Unlike when using bootc usr-overlay
, --transient
and persistence=transient
ensure that the /usr
directory remains read-only to other processes before, during, and after the transaction.
For example, to transiently install the make
package, enter:
dnf install --transient make
# dnf install --transient make
6.6. Shells and command-line tools
RHEL 10 provides polkit in version 125
The polkit package is upgraded to version 125. Notable enhancements include the following:
-
polkit uses the
tmpfiles.d
file to store configuration in the/etc/polkit-1
directory. -
polkit now supports
syslog-style
log levels and LogControl protocol for dynamic loglevel changing.
The rebase allows the removal of /etc/polkit-1/<subdirs>
directories and their automatic recreation with appropriate access rules on the next boot. It aligns polkit with the reset OS to factory settings by deleting /etc
approach. Now, the user does not have to reinstall polkit, if the /etc/polkit-1
directory was deleted.
Additionally, the polkit.service
unit file now contains a new parameter specified in the call of polkitd daemon, that is, --log-level=<level>
. By default in RHEL 10, this parameter is set to --log-level=err
, logging only error messages. If the parameter --log-level
is omitted, only critical messages are logged.
This change allows users to control how verbose polkit should be in logs and especially in the journal. The enhancement addresses the requirement to log every loaded .rules
file for debug purposes, preventing the journal from being flooded with unnecessary information.
RHEL 10 provides ksh in version 93u+m/1.0.10
The KornShell
(ksh) shell is upgraded to the 93u+m/1.0.10 version. The notable changes are:
-
The
alarm
command, a shell built-in part of ksh, is no longer supported and will be removed. The replacement is thecron
daemon, a utility for tasks that must run at fixed intervals. - The ksh shell is now capable of handling more than 32767 simultaneous background jobs, subject to system limitations.
-
Fixes a bug that caused an incorrect default exit status for
exit
within a trap action and a race condition occurring on some systems when running an external command with a redirection from a command substitution. - Various other bug fixes
Traceroute now defaults to IPv6
Previously, traceroute defaulted to IPv4 addresses even when IPv6 addresses were available. With this enhancement, traceroute now defaults to IPv6 if available.
Changes in the polkit-rules
visibility
Previously, in the version polkit-123, the default file mode for files in the /usr/share/polkit-1/rules.d
directory was set explicitly, so it did not inherit the mode from the parent directory. The default file mode for files in the /etc/polkit-1/rules.d
directory was previously owned by the polkitd
. With this enhancement, the notable changes include the following:
- The
/usr/share/polkit-1/rules.d
directory -
The default permission mask for files in
/usr/share/polkit-1/rules.d
is changed from700 polkitd root
to755 root root
, and is now visible to all users. - The reason behind the change is that files in this directory are endorsed by various packages and are accessible in the project’s public repositories.
- Previously, the permission mask or file mode was non-standard. The new file permission mask is also aligned with the Filesystem Hierarchy Standard (FHS).
-
The default permission mask for files in
- The
/etc/polkit-1/rules.d
directory -
Files in the
/etc/polkit-1/rules.d
directory represent adjustments created by the system administrator (custom rules that are different from the vendored rules that reside in the/usr/share/polkit-1/rules.d
). These files can contain customer-specific data about specific personnel and their privileges. -
The default permission mask for files in the
/etc/polkit-1/rules.d
directory has been changed to0750 root polkitd
for increased security. The polkit daemon is in thepolkitd
group and this group only hasread
access to the files instead of thewrite
access. Even in the case of unauthorized access to the polkit daemon, the attacker cannot change the rules and cannot grant someone any other privileges. The files are also invisible to any user other thanroot
orpolkitd
group.
-
Files in the
Do not store your custom .rules
files in /usr/share/polkit-1/rules.d
. For safety reasons, store or migrate your custom rules to the /etc/polkit-1/rules.d directory
.
Jira:RHELDOCS-16414[1]
RHEL 10 provides systemd
version 257
The systemd
package has been rebased to version 257. Notable changes include:
-
Support for
cgroup v1
, includinglegacy
andhybrid
hierarchies, is now considered obsolete. Now,systemd
always usescgroup v2
, even ifsystemd.legacy_systemd_cgroup_controller=yes
is set on the kernel command line. -
Support for
System V
service scripts is deprecated and will be removed in future versions. -
Default configuration files are now located under the
/usr/lib/systemd/
directory instead of/etc/systemd/
. The default configuration files can be overridden by a user configuration from/etc
or extended by using drop-in files similarly to unit files. For more details, see the CONFIGURATION DIRECTORIES AND PRECEDENCE section in systemd-system.conf(5) man pages of the respective configuration files.
Note: Update your software now to include a native systemd
unit file instead of a legacy System V
script to maintain compatibility with future systemd
releases.
Jira:RHELDOCS-19411[1]
RHEL 10 provides ReaR in version 2.9
The ReaR utility has been upgraded to version 2.9 . The notable changes include :
-
On IBM Z, the
IPL
output method is now deprecated. TheRAMDISK
output method is provided as an alternative. TheOUTPUT=RAMDISK
functionality is identical on all the supported hardware architectures, unlike the deprecatedOUTPUT=IPL
functionality, which is specific to IBM System Z.
Note that the names of the recovery ramdisk image and the kernel that are generated by ReaR are different with OUTPUT=RAMDISK
. The kernel is named kernel-$RAMDISK_SUFFIX
and the ramdisk image is named initramfs-$RAMDISK_SUFFIX.img
. The RAMDISK_SUFFIX
is a configuration variable that you can set in /etc/rear/local.conf
. If the variable is not set, it defaults to the host name of the system. If you used the OUTPUT=IPL
setting with previous ReaR versions, change it to OUTPUT=RAMDISK
and adjust any automation that uses the resulting kernel and ramdisk image files according to the new naming convention described above to be compatible with future ReaR versions when the IPL
output method is removed.
-
The default value of the
ISO_VOLID
configuration variable, which specifies the label of the resulting ISO image when using theOUTPUT=ISO
setting, was changed toREAR-ISO
. The default in previous ReaR versions wasRELAXRECOVER
. If you need to mount the resulting ISO 9660 file system by label, adjust themount
command for the label change. Alternatively, you can set theISO_VOLID
variable in/etc/rear/local.conf
toRELAXRECOVER
to restore the former behavior.
Jira:RHEL-72557[1]
The tmux
service is now available
The system administrator can now set up a tmux
session for specific users at boot. This is useful on systems, where the KillUserProcesses=yes
parameter is set and users are not configured to linger.
RHEL 10 provides openCryptoki
version 3.24.0
The openCryptoki
packages are provided in version 3.24.0. Support has been added for the following:
- CCA token on non-IBM Z platforms (x86_64, ppc64)
- IBM Dilithium
- RSA-OAEP with SHA-224, SHA-384, and SHA-512 on encryption and decryption
- PKCS #11 v3.0 SHA-3 mechanisms
- SHA-2 mechanisms
- SHA-based key derivation mechanisms
- Protecting tokens with a token specific user group
-
New
libica
AES-GCM API using the KMA instruction on z14 and later
Jira:RHEL-58996[1]
6.7. Infrastructure services
tuned-ppd
, Valkey
, libcpuid
and dnsconfd
packages are now available
The following packages are included in Red Hat Enterprise Linux:
-
tuned-ppd
: Thetune-ppd
is a replacement ofdrop-in power-profiles-daemon
which usesTuneD
as a backend. -
Valkey
: Replaces redis and provides the same features. -
libcpuid
: Enables accurate CPU model identification inTuneD
. -
dnsconfd
: A local DNS cache configuration daemon that simplifies setting up DNS caching, split DNS, DNS over TLS, and other DNS features.
Jira:RHELDOCS-18925[1]
GECOS field for root user is changed to Super User
Previously, an application output for the GECOS/description appeared as root
. Now, the GECOS/description for user root
in the /etc/passwd
file has been changed from root
to Super User
.
Jira:RHELDOCS-18776[1]
dnsconfd
daemon can now be installed
With this enhancement, you can now install the dnsconfd
, a local DNS cache configuration daemon. The newly configured daemon provides an easy way to set up DNS caching, split DNS, DNS over TLS, and other DNS features.
Jira:RHEL-34791[1]
The Kea DHCP server replaces ISC DHCP
Kea is a new Dynamic Host Configuration Protocol (DHCP) server solution in RHEL. Kea DHCP is an implementation from Internet Systems Consortium (ISC) that includes fully functional DHCPv4, DHCPv6, and Dynamic DNS servers. The Kea DHCP server has the following advantages:
- It is an extensible server solution with module hooks.
- It allows re-configuration through the REST API.
- It has a design that allows separation of data (leases) and execution environment.
Jira:RHEL-9306[1]
Weak ciphers can be now disabled in CUPS configuration
Previously, when you disabled the weak cipher in the system-wide cryptographic policy followed by CUPS configurations, the configuration changes did not take effect. With this enhancement, if a user wants to disable a certain cryptographic algorithm via system policy, CUPS honors the system settings, unless SSLOptions NoSystem
is set in CUPS configuration files. In that case CUPS does not offer the system-wide disabled algorithm anymore.
As a result, by default, now Cupsd
and libcups
follow system crypto policy. You can opt-out from crypto policy by setting SSLOptions NoSystem
in the following configuration files:
-
/etc/cups/client.conf
: for applications usinglibcups
-
/etc/cups/cupsd.conf
: forcupsd
daemon
It is not secure to set the NoSystem
value, as it allows weaker algorithms to be enabled if they are disabled by system crypto policy. It should be used only if the other part in communication does not support any better crypto algorithms.
Jira:RHEL-68415[1]
6.8. Networking
RHEL 10 provides nftables
version 1.1.1
The RHEL nftables
framework has implemented changes from upstream versions 1.1.0 and 1.1.1. This update provides multiple bug fixes and enhancements. Notable changes include:
- Added support for multiple devices in JSON format.
- Increased performance when listing tables.
- Added virtual local area network (VLAN) ID match and set support, including the 802.1ad (Q-in-Q) standard.
- Enabled zero burst in byte rate limiter.
-
Added egress support for
list hooks
. -
Fixed listing inconsistencies in the
nft list hooks
command.
For more details and a full list of changes, see:
RHEL 10 provides iptables
version 1.8.11
The iptables
framework has been upgraded to version 1.8.11, which provides multiple bug fixes and enhancements. Notable changes include:
-
New
arptables-translate
utility ebtables-nft
:-
Print negations (exclamation marks) before the match they invert for consistency with
iptables
. -
Support
--replace
and--list-rules
command options.
-
Print negations (exclamation marks) before the match they invert for consistency with
iptables-translate
:-
Align protocol name lookups with
iptables
. -
Support socket match with
TPROXY
target.
-
Align protocol name lookups with
iptables
:-
Enable implicit extension lookup for
dccp
andipcomp
protocols so that no extra-m <proto>
command option is needed after-p <proto>
.
-
Enable implicit extension lookup for
iptables-save
:-
Avoid calls to the
getprotobynumber()
function for consistency and improved performance with huge rule sets.
-
Avoid calls to the
arptables-nft
:-
Fixed wrong formatting of
--h-type
values and--proto-type
masks which caused misinterpretation byarptables-restore
. -
Improved ineffective masks when specified in
--h-type
,--opcode
and--proto-type
matches.
-
Fixed wrong formatting of
iptables-nft
:- Fixed wrong error messages in corner-case error conditions.
- Fixed incorrect combination of inverted payload matches.
For more details, see the upstream documentation.
RHEL 10 provides firewalld
version 2.3.0
The firewalld
service version 2.3.0 provides multiple enhancements. Notable changes include:
-
Added the
StrictForwardPorts
(boolean, defaults to "no") configuration option that allowsfirewalld
to be strict about Destination NAT traffic. When enabled, only forward ports explicitly enabled infirewalld
are allowed. This means that container-published ports will be blocked. For more information about the feature, see StrictForwardPorts. Added support for the following services:
-
client/server on Advanced Linux Sound Architecture (ALSA) sequencer (
aseqnet
) - Music Player Daemon (MPD)
- Radsec
- SlimeVR
-
client/server on Advanced Linux Sound Architecture (ALSA) sequencer (
For more details about the release updates, see the upstream repository.
RHEL 10 provides xdp-tools
version 1.5.1
The xdp-tools
package has been upgraded to version 1.5.1, which provides multiple enhancements and bug fixes. Notable changes include:
-
Added the
xdp-forward
utility that enables XDP-accelerated packet forwarding between supported network devices. -
Updated the
xdp-trafficgen
utility to support specifying User Datagram Protocol (UDP) packet sizes. - Added a new option-based API for creating XDP sockets (XSK) and user memory (UMEM) objects.
The RHEL kernel supports the netkit
network device type
The RHEL kernel now supports the netkit
network device type, which enables Berkeley Packet Filter (BPF) based high performance networking for containers. This change should positively impact efficiency, scalability, and responsiveness of containerized applications that are deployed with a Container Network Interface (CNI) that supports the netkit
network device type, particularly in cloud environments and high-throughput systems.
Jira:RHEL-51429[1]
The i40e driver supports automatic reset behavior on MDD events
The Intel® Network Adapter Driver for PCIe* 40 Gigabit Ethernet can now reset problematic Single Root I/O Virtualization (SR-IOV) virtual functions (VFs) when it detects a malicious driver detection (MDD) event. You can activate this automatic reset behavior through the new mdd-auto-reset-vf
option as in the following example command:
ethtool --set-priv-flags _ethX_ *mdd-auto-reset-vf* on
ethtool --set-priv-flags _ethX_ *mdd-auto-reset-vf* on
When the VF sends malformed packets classified as malicious, it can cause the Tx queue to freeze, which makes it unusable for several minutes. However, with mdd-auto-reset-vf
enabled, a graceful VF reset automatically restores operational state when an MDD event occurs.
Jira:RHEL-73034[1]
nmstate
supports the require-id-on-certificate
setting on Libreswan configuration
With this enhancement, libreswan
, an implementation of Internet Protocol Security (IPsec) specification, now supports the require-id-on-certificate
setting for VPN configurations by using NetworkManager. With this feature, you can configure Subject Alternative Name (SAN) validation by using the require-id-on-certificate
option. As a result, this implementation correctly enforces SAN validation based on the specified setting:
-
No SAN validation is performed when set to
no
-
SAN are validated when set to
yes
Jira:RHEL-58812[1]
RHEL 10 provides wpa_supplicant
version 2.11
The wpa_supplicant
service has been upgraded to version 2.11, which provides multiple enhancements and bug fixes. Notable changes include:
- Added support for Device Provisioning Protocol (DPP) release 3.
- Added support for GCM-AES-256 cipher suite.
- Added support for Basic Service Set (BSS) Color updates.
- Implemented OpenSSL 3.0 API changes.
For more information and the full list of changes, see the upstream announcement.
Jira:RHEL-59010[1]
6.9. Kernel
Kernel version in RHEL 10.0
Red Hat Enterprise Linux 10.0 is distributed with the kernel version 6.12.0.
Dynamic EFIVARS
pstore backend is now supported
With this release, you can dynamically enable the EFIVARS
pstore backend at runtime to efficiently manage the system storage.
Previously, the pstore storage backend required a reboot to modify its configuration. With this release, you can switch between supported backends such as NVMe
and EFIVARS
without rebooting the system.
Also, enhancements in pstore logging provide better clarity on indications of the currently active backend.
If there is no pstore backend registered on your system, enable the efi_pstore
for UEFI boot:
echo "N" > /sys/module/efi_pstore/parameters/pstore_disable
# echo "N" > /sys/module/efi_pstore/parameters/pstore_disable
[ 90.116913] pstore: Using crash dump compression: deflate
[ 90.118433] pstore: Registered efi_pstore as persistent store backend
Jira:RHELDOCS-19988[1]
Containerization of the rteval
utility
With this update, you can run the rteval
utility with all its runtime dependencies from a container image publicly available through the Quay.io container registry. You can:
-
Enjoy the deployment flexibility, where older RHEL versions can get newer versions of
rteval
. - Create an isolated environment to ensure the performance evaluations do not disrupt other system processes or consume excessive resources.
-
Run multiple
rteval
instances on the same or multiple hosts. -
Allocate specific system resources to
rteval
, ensuring better resource usage control.
Alternatively, you can use the related Docker file to build your own container image with rteval
. This Docker file is located in the upstream repository and provided as part of the source RPM (SRPM).
Jira:RHEL-28059[1]
New option to disable idle states locally on CPUs during rtla-timerlat
testing: deepest-idle-state
The arguments for the deepest-idle-state
are the number of the deepest allowed idle state. If -1 is the value in the argument, it * disables all idle states. In the rtla-timerlat
instead of using /dev/cpu_dma_latency
to disable the CPUs in the idle state globally, the deepest-idle-state
option is added to set the deepest allowed idle state for CPUs where measurements are running.
As a result, you can save power and reflect the real-time workload during rtla-timerlat
testing and use the deepest-idle-state
instead of using the /dev/cpu_dma_latency
to disable them globally.
Jira:RHEL-40744[1]
Deadline (DL) server implements a two-stage scheduler for CFS tasks
RHEL 10 introduces a new in-kernel Deadline (DL) server that implements a two-stage scheduler. It provides guaranteed execution time for Completely Fair Scheduler (CFS) tasks, mitigating potential starvation caused by Real Time (RT) or Deadline (DL) tasks.
The new DL server, running at deadline priority, schedules CFS tasks every 1 second, allocating an initial 50-millisecond runtime window for the execution. This ensures that CFS tasks receive periodic CPU time even when preempted by higher-priority RT or DL tasks. The runtime and period parameters can be adjusted on a per-CPU basis by using /sys/kernel/debug/sched/fair_server/cpu*/{runtime, period}
. Setting a runtime of 0
disables the DL server for the specified CPU.
The DL server eliminates the need for external tools, such as stallD
, for starvation prevention and removes the requirement for manual configuration and tuning of such tools.
This provides a robust, integrated, and transparent solution for CFS task scheduling directly within the kernel.
Jira:RHEL-58211[1]
Landlock, a new Linux Security Module (LSM) is released
RHEL 10.0 introduces Landlock, a new security feature that makes your containers safer. Landlock sets strict rules for processes like Podman to limit access to the file system through the kernel API, defining rules for themselves regardless of privilege level and allowing users to create hard limits over the accessible scope of the processes.
With Landlock, you can build programs that mitigate potential risks associated with misconfigured or maliciously targeted processes. This makes containers and the whole system more secure.
Jira:RHEL-40283[1]
rh_waived
kernel command-line boot parameter is now supported
With this release, the rh_waived
kernel command-line boot parameter is supported. rh_waived
is used for enabling waived features in RHEL. The waived features are kernel features considered unmaintained, insecure, rudimentary, or deprecated. These features are disabled by default in RHEL 10. To use waived features, you must enable them manually.
Jira:RHEL-26170[1]
New timerlat-interval INTV_US
and cyclictest-interval INTV_US
options
With this enhancement, you can use the following new options of the rteval
command to modify the base or periodic interval option in running timerlat
or cyclictest
threads:
-
timerlat-interval INTV_US
-
cyclictest-interval INTV_US
Note that if you do not use either of these options with rteval
, the default value is applied.
Jira:RHEL-67424[1]
New option to disable idle states locally on latency testing with cyclictest
-
The
cyclictest
tool sets/dev/cpu_dma_latency
to 0 by default to avoid increased latency when waking up from idle, which disables idle states on all CPUs. -
The new
deepest-idle-state
option only disables idle states on CPUs which are selected for the testing. The argument specifies the deepest allowed idle state, setting it to-1
disables all idle states on the measured CPUs. -
Tuning with the
cyclictest
is supposed to reflect the real-time workload testing, and thus using thedeepest-idle-state
instead of using the/dev/cpu_dma_latency
to disable the CPU idle states reflects a use case where the real-time workload only disables idle states on the CPU where it is running. -
As a result, the
cyclictest
coverage of addressing all use cases is increased, and power consumption decreases.
Jira:RHEL-65488[1]
New integration testing to validate kdump
procedures to prevent system failure
With this enhancement, you can check the log file for kdump
procedures after any software or hardware updates to prevent system failure. After the analysis of the output log files, the configuration entries, such as memory issues
or blacklist of some drivers
, are corrected to validate the kdump
procedures and generate the vmcore
. This ensures that the kdump
procedures are validated and corrected before a system crash after any software or hardware update.
Jira:RHEL-29941[1]
6.10. Boot loader
RHEL 10 provides grub2 in version 2.12
grub2
version rc2.12 provides many bug fixes and enhancements. The notable changes are:
- GCC 13 support.
- clang 14 support.
- binutils 2.38 support.
- Support for dynamic GRUB runtime memory addition using firmware calls.
- PCI and MMIO UARTs support.
- SDL2 support.
- LoongArch support.
- TPM driver fixes.
- Many filesystems fixes.
- Many CVE and Coverity fixes.
- Debugging support improvements.
- Tests improvements.
- Documentation improvements.
- vlan support
Jira:RHEL-15032[1]
6.11. File systems and storage
RHEL 10 provides python-blivet
version 3.10
The python-blivet
package has been rebased to version 3.10, providing various bug fixes and enhancements. The most notable changes are:
- Removed support for Python 2.
- Support for adding disks to the existing Stratis pool.
- Support for Stratis encryption with Clevis or Tang.
-
Support for semi-automatic resizing of the
lvmpv
format to fill underlying block devices.
RHEL 10 provides cryptsetup
version 2.7
The cryptsetup
package has been rebased to version 2.7. This version provides various bug fixes and enhancements, most notably:
-
Improvements for the
libcryptsetup
package to support LUKS encrypted devices in thekdump
enabled systems. - Critical fixes for LUKS2 SED OPAL feature.
- Avoids known or already fixed issues with LUSK2 SED OPAL feature.
Jira:RHEL-33395[1]
GPT is now the default partition table for IBM Power Systems, Little Endian and 64-bit IBM Z architectures
The GPT partition table is now selected by default instead of MSDOS when installing RHEL 10 for all newly partitioned disks during the installation.
The GPT partition table is not selected by default for direct access storage device (DASD) drives on 64-bit IBM Z architecture, where the DASD partition table remains unchanged.
This update simplifies and standardizes the default partitioning behavior across different architectures and platforms.
AMD and Intel 64-bit architectures and other products, such as RHEL Image Mode, already use the GPT partition table by default.
snapm
is now available in RHEL
Snapshot Manager (snapm
) is a new component designed to assist in managing system state snapshots. You can use it to roll back updates or changes, and boot into previous system snapshots. Managing snapshots across multiple volumes and configuring boot entries for snapshot boot and snapshot rollback can often be complex and prone to errors. Snapshot Manager automates these common tasks and integrates seamlessly with Boom Boot Manager, simplifying the process. With this update, you can easily take snapshots of the system state, apply updates, and revert to the previous system state if necessary.
Jira:RHEL-59006[1]
RHEL 10 provides device-mapper-multipath
version 0.9.9
The device-mapper-multipath
package has been updated from version 0.8.7 to 0.9.9. Notable enhancements include:
-
The
multipathd.socket systemd
unit is no longer enabled by default.multipathd
continues to run automatically on boot. However, if stopped, it does not restart automatically if there is a block deviceuevent
or certainmultipath
commands are run. To keep it enabled, restart manually or uncomment the following in themultipathd.socket systemd
file:
WantedBy=sockets.target
# WantedBy=sockets.target
-
multipathd
now attempts to run as a real-time process with a moderate priority (10) by default. If unsuccessful, it continues to run as a normal process, but with an increased priority. You can control this, by modifying the standardsystemd
options, for example, LimitRTPRIO and CPUWeight in themultipathd.service systemd
file. -
systemctl reload multipathd.service
ormultipathd reconfigure
commands now reload a device only if something has changed, instead of reloading everymultipath
device including the ones that are unchanged. To force a reload of all devices, run :
multipathd reconfigure all
multipathd reconfigure all
The following
multipath.conf
options were deprecated and are not recognized in RHEL 10.multipath
triggers a warning message if they are included in themultipath
file:RHEL 9:
-
multipath_dir
-
config_dir
-
bindings_file
-
wwids_file
-
prkeys_file
-
getuid_callout
-
disable_changed_wwids
-
RHEL 8:
-
default_selector
-
default_path_grouping_policy
-
default_uid_attribute
-
default_getuid_callout
-
default_features
-
default_path_checker
-
-
Path grouping policy,
group_by_tpg
, is introduced to group paths by their ALUA target port group. This ensures that all paths with the same target port group belong to the same pathgroup. It functions similar to the group_by_prio policy, but prevents misgrouping when paths change priorities.
All the paths in the multipath device must have their priority function set to alua
or syfs
to use this policy.
Configuration settings
detect_pgpolicy
anddetect_pgpolicy_use_tpg
are introduced which can be set in overrides, devices, and defaults sections.-
If
detect_pgpolicy
is enabled,multipath
setspath_grouping_policy
togroup_by_prio
orgroup_by_tpg
foralua
orsysfs
prioritizer. If it is disabled,path_grouping_policy
configuration set for the device is used.detect_pgpolicy
is enabled by default. -
If
detect_pgpolicy_use_tpg
is enabled,detect_pgpolicy
setspath_grouping_policy
togroup_by_tpg
. If it is disabled,detect_pgpolicy
setspath_grouping_policy
togroup_by_prio
.detect_pgpolicy_use_tpg
is disabled by default.
-
If
New wildcards for formatted output in
multipathd
:New maps format wildcard:
-
k:
max_sectors_kb
-
k:
New paths format wildcards:
-
I:
init state
- L: LUN hex
-
A:
alua
target port group -
k:
max_sectors_kb
-
I:
Jira:RHELDOCS-19812[1]
The dm-vdo
module has been added to the kernel
With this update, the kmod-kvdo
module has been replaced with the dm-vdo
module in the RHEL 10 kernel. In addition, the Virtual Data Optimizer (VDO) sysfs
parameters have been removed. For more information on the removed sysfs
parameters, see Removed features in File systems and storage.
Jira:RHELDOCS-19842[1], Jira:RHELDOCS-19066
nvme-cli
and cryptsetup
are now available for Opal automation on NVMe SEDs
NVMe Self-Encrypting Drives (SED) support the Opal storage specification of hardware encryption technology to secure data stored in the drive. Previously, Opal support for NVMe SEDs required manual interaction to manage passwords to access the data.
With this update, you can use nvme-cli
and cryptsetup
to automate encryption management and drive unlocking.
Run the following commands to use NVMe SED options on NVMe SSD:
- To discover SED Opal locking features:
nvme sed discover /dev/nvme0n1
# nvme sed discover /dev/nvme0n1
Locking Features:
Locking Supported: Yes
Locking Feature Enabled: No
Locked: No
- To initialize an SED Opal device for locking:
nvme sed initialize /dev/nvme0n1 nvme sed discover /dev/nvme0n1
# nvme sed initialize /dev/nvme0n1
New Password:
Re-enter New Password:
# nvme sed discover /dev/nvme0n1
Locking Features:
Locking Supported: Yes
Locking Feature Enabled: Yes
Locked: No
- To lock a SED Opal device:
nvme sed lock /dev/nvme0n1 nvme sed discover /dev/nvme0n1
# nvme sed lock /dev/nvme0n1
# nvme sed discover /dev/nvme0n1
Locking Features:
Locking Supported: Yes
Locking Feature Enabled: Yes
Locked: Yes
- To unlock a SED Opal device:
nvme sed unlock /dev/nvme0n1 nvme sed discover /dev/nvme0n1
# nvme sed unlock /dev/nvme0n1
# nvme sed discover /dev/nvme0n1
Locking Features:
Locking Supported: Yes
Locking Feature Enabled: Yes
Locked: No
- To change the SED Opal device password:
nvme sed password /dev/nvme0n1
# nvme sed password /dev/nvme0n1
Password:
New Password:
Re-enter New Password:
- To revert an SED Opal device from locking:
nvme sed lock /dev/nvme0n1 nvme sed discover /dev/nvme0n1 nvme sed unlock /dev/nvme0n1 nvme sed discover /dev/nvme0n1 nvme sed revert /dev/nvme0n1
# nvme sed lock /dev/nvme0n1
# nvme sed discover /dev/nvme0n1
Locking Features:
Locking Supported: Yes
Locking Feature Enabled: Yes
Locked: Yes
# nvme sed unlock /dev/nvme0n1
# nvme sed discover /dev/nvme0n1
Locking Features:
Locking Supported: Yes
Locking Feature Enabled: Yes
Locked: No
# nvme sed revert /dev/nvme0n1
- To reset an SED Opal device to disable locking with destructive revert:
nvme sed lock /dev/nvme0n1 nvme sed discover /dev/nvme0n1 nvme sed revert -e /dev/nvme0n1
# nvme sed lock /dev/nvme0n1
# nvme sed discover /dev/nvme0n1
Locking Features:
Locking Supported: Yes
Locking Feature Enabled: Yes
Locked: Yes
# nvme sed revert -e /dev/nvme0n1
Destructive revert erases drive data. Continue (y/n)? y
Are you sure (y/n)? y
Password:
# nvme sed discover /dev/nvme0n1
Locking Features:
Locking Supported: Yes
Locking Feature Enabled: No
Locked: No
Note: Use nvme sed revert
without the -e
parameter to avoid erasing data on the NVMe disk.
The device may be either an NVMe character device such as /dev/nvme0
, an NVMe block device such as /dev/nvme0n1
, or an mctp
address in the form mctp:<net>,<eid>[:ctrl-id]
.
Example command to use an NVMe OPAL device on RHEL 10 with nvme-cli:
- Initialize, lock, and unlock an NVMe disk, and verify that data on the disk remains unchanged after unlocking:
mount /dev/nvme0n1p1 /mnt/ dd if=/dev/urandom of=/mnt/test.file bs=1M count=1024 md5sum /mnt/test.file umount /dev/nvme0n1p1 nvme sed discover /dev/nvme0n1 nvme sed initialize /dev/nvme0n1 nvme sed lock /dev/nvme0n1 nvme sed discover /dev/nvme0n1 mount /dev/nvme0n1p1 /mnt/ nvme sed unlock /dev/nvme0n1 mount /dev/nvme0n1p1 /mnt/ md5sum /mnt/test.file umount /dev/nvme0n1p1 nvme sed discover /dev/nvme0n1 nvme sed revert /dev/nvme0n1 nvme sed discover /dev/nvme0n1
# mount /dev/nvme0n1p1 /mnt/
# dd if=/dev/urandom of=/mnt/test.file bs=1M count=1024
1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 3.65616 s, 294 MB/s
# md5sum /mnt/test.file
57edc80dab5bf803d0944e281bf2e9dd /mnt/test.file
# umount /dev/nvme0n1p1
# nvme sed discover /dev/nvme0n1
Locking Features:
Locking Supported: Yes
Locking Feature Enabled: No
Locked: No
# nvme sed initialize /dev/nvme0n1
New Password:
Re-enter New Password:
# nvme sed lock /dev/nvme0n1
# nvme sed discover /dev/nvme0n1
Locking Features:
Locking Supported: Yes
Locking Feature Enabled: Yes
Locked: Yes
# mount /dev/nvme0n1p1 /mnt/
mount: /mnt: can't read superblock on /dev/nvme0n1p1.
dmesg[8] may have more information after a failed mount system call.
# nvme sed unlock /dev/nvme0n1
# mount /dev/nvme0n1p1 /mnt/
# md5sum /mnt/test.file
57edc80dab5bf803d0944e281bf2e9dd /mnt/test.file
# umount /dev/nvme0n1p1
# nvme sed discover /dev/nvme0n1
Locking Features:
Locking Supported: Yes
Locking Feature Enabled: Yes
Locked: No
# nvme sed revert /dev/nvme0n1
Password:
# nvme sed discover /dev/nvme0n1
Locking Features:
Locking Supported: Yes
Locking Feature Enabled: No
Locked: No
Jira:RHELDOCS-19877[1]
RHEL 10 provides NFS with TLS support
Network File System (NFS) with Transport Layer Security (TLS) is fully supported. This feature enhances NFS security by enabling TLS for Remote Procedure Call (RPC) traffic, ensuring encrypted communication between clients and servers. For details, see Configuring an NFS server with TLS support.
Note that NFS with TLS relies on support from kernel TLS (kTLS). The kTLS feature for general use is provided as a Technology Preview. For details see the release notes in the Technology Preview features chapter.
Jira:RHEL-74415[1]
CIFS client provides the ability to create special files under SMB shares
Common Internet File System (CIFS) client has the ability to create native Server Message Block (SMB) symlinks by default. You can also create special files, such as character devices, block devices, pipes, and sockets, through Network File System (NFS) or Windows Subsystem for Linux (WSL) reparse points by using the reparse=default|nfs|wsl
mount option.
Jira:RHEL-78152[1]
Atomic write is now available
RHEL 10 introduces atomic write as a cross-subsystems enhancement across the file system, block layer, and drivers. The RWF_ATOMIC
flag is used to enable torn-write protection. This ensures that after a system crash or power failure, either all or none of the written data is present on stable storage. In this scenario, partial data writes or torn writes do not occur.
Existing write operations are not atomic, and can be interrupted mid-operation. This can result in partially written data in case of crash and power failures.
This enhancement enables applications that provide critical data consistency guarantees, such as databases, to optimize the performance of their consistency algorithms.
Jira:RHEL-60811[1]
6.12. High availability and clusters
pcs
now validates resource parameters when creating or updating a resource
When you create or update a cluster resource, the pcs
command-line interface now automatically asks the resource agent to validate the parameters you entered. If you specify --agent-validation
, an invalid parameter yields an error. To maintain backward compatibility, if you do not specify --agent-validation
, an invalid parameter prints a warning but does not prevent misconfiguration.
New --yes
flag to confirm potentially destructive actions
To confirm potentially destructive actions such as destroying a cluster, unblocking quorum, or confirming a node being fenced, the pcs
command-line interface now supports the --yes
flag. Previously, you could confirm these actions by using the --force
flag, which is also used for overriding validation errors. With these two functions combined in a single flag, a user could inadvertently confirm a potentially destructive action when the intention is only to override a validation error. You should now use the --force
flag to override validation errors, and you should use the --yes
flag to confirm potentially destructive actions.
New pcs status wait
command
The pcs
command-line interface now provides a pcs status wait
command. This command ensures that Pacemaker has completed any actions required by changes to the Cluster Information Base (CIB) and does not need to take any further actions in order to make the actual cluster state match the requested cluster state.
Jira:RHEL-38491[1]
pcs
support for new commands to query the status of a resource in a cluster
The pcs
command-line interface now provides pcs status query resource
commands to query various attributes of a single resource in a cluster. These commands query:
- the existence of the resource
- the type of the resource
- the state of the resource
- various information about the members of a collective resource
- on which nodes the resource is running
You can use these commands for pcs-based scripting since there is no need to parse plain text outputs.
Jira:RHEL-38489[1]
New pcs resource defaults
and pcs resource op defaults
option for displaying configuration in text, JSON, and command formats
The pcs resource defaults
and pcs resource op defaults
commands and their aliases pcs stonith defaults
and pcs stonith op defaults
now provide the --output-format
option.
-
Specifying
--output-format=text
displays the configured resource defaults or operation defaults in plain text format, which is the default value for this option. -
Specifying
--output-format=cmd
displays thepcs resource defaults
orpcs resource op defaults
commands created from the current cluster defaults configuration. You can use these commands to re-create configured resource defaults or resource operation defaults on a different system. -
Specifying
--output-format=json
displays the configured resource defaults or resource operation defaults in JSON format, which is suitable for machine parsing.
Jira:RHEL-38487[1]
pcsd
Web UI now available as a RHEL web console add-on
The pcsd
Web UI is now available as the HA Cluster Management RHEL web console add-on when the cockpit-ha-cluster
package is installed. It is no longer operated as a standalone interface.
New Pacemaker option to leave a panicked node shut down without rebooting automatically
You can now set the PCMK_panic_action
variable in the /etc/sysconfig/pacemaker
configuration file to off
or sync-off
. When you set this variable to off
or sync-off
, a node remains shut down after a panic condition instead of rebooting automatically.
New pcs tag
command option for displaying cluster resource tags in text, JSON, and command formats
The pcs tag [config]
command now supports the --output-format
option for the following use cases:
-
Displaying the configured text in plain text format by specifying
--output-format=text
. This is the default value for this option. -
Displaying the commands created from the current cluster tags configuration by specifying
--output-format=cmd
. You can use these commands to re-create configured tags on a different system. -
Displaying the configured tags in JSON format by specifying
--output-format=json
, which is suitable for machine parsing.
Support for exporting fencing level configuration in JSON format and as pcs
commands
The pcs stonith config
and the pcs stonith level config
commands now support the --output-format=
option to display the fencing level configuration in JSON format and as pcs
commands.
-
Specifying
--output-format=cmd
displays thepcs
commands created from the current cluster configuration that configure fencing levels. You can use these commands to re-create configured fencing levels on a different system. -
Specifying
--output-format=json
displays the fencing level configuration in JSON format, which is suitable for machine parsing.
Deleting multiple resources with a single pcs
command
Before this update, the pcs resource delete
, the pcs resource remove
, the pcs stonith delete
and the pcs stonith remove
commands supported the removal of only one resource at a time. With this update, you can now delete multiple resources at once with a single command.
Simplified configuration of globally unique cluster resource clones
To configure a cluster resource clone to be globally unique, it is now sufficient to configure the clone option clone-node-max > 1
when creating the clone of a previously created resource or resource group. It is no longer necessary to configure the clone option globally-unique="true"
as well.
Support for encryption of Pacemaker remote connections using SSL certificates
You can now encrypt Pacemaker remote connections by using X.509 (SSL/TLS) certificates. Previously, only pre-shared keys (PSK) were supported for encryption. With support for SSL certificates, you can use existing host certificates for Pacemaker remote connections.
To configure SSL/TLS certificates for Pacemaker remote connections:
-
Create a remote connection with the
pcs cluster node add-guest
command or thepcs cluster node add-remote command
. When you create a remote connection, the connection uses PSK encryption. -
Convert the remote connection to use certificates by updating the
PCMK_ca_file
,PCMK_cert_file
,PCMK_key_file
, and, optionally, thePCMK_crl_file
variables on all cluster nodes and Pacemaker remote nodes.
For information on configuring encryption with SSL certificates, see Host and guest authentication of pacemaker_remote
nodes.
Updated date specification and duration options in Pacemaker rules
Pacemaker rules no longer support the following options:
-
Invalid
duration
options:monthdays
,moon
,weekdays
,weekyears
,yearsdays
-
Invalid
date-spec
options:moon
,yearsdays
Pacemaker rules now support the following options:
-
The supported
duration
options are nowseconds
,minutes
,hours
,days
,weeks
,months
, andyears
. -
The supported
date-spec
options are nowseconds
,minutes
,hours
,monthdays
,weekdays
,yeardays
,months
,weeks
,years
, andweekyears
.
You can configure rules that incorporate duration
and date-spec
options in the following pcs
commands:
-
pcs resource defaults
-
pcs stonith defaults
-
pcs resource op defaults
-
pcs stonith op defaults
-
pcs constraint location
Jira:RHEL-49527, Jira:RHEL-49524
Removing Booth cluster tickets from the CIB after removal from the Booth configuration
After you remove a Booth cluster ticket by using the pcs booth ticket remove
command, the state of the Booth ticket remains loaded in the Cluster Information Base (CIB). This is also the case after you remove a ticket from the Booth configuration on one site and pull the Booth configuration to another site by using the pcs booth pull
command. This might cause problems when you configure a ticket constraint, because a ticket constraint can be granted even after a ticket has been removed. As a consequence, the cluster might freeze or fence a node. You can prevent this by removing a Booth ticket from the CIB with the pcs booth ticket cleanup
command.
For information about removing a Booth ticket from the CIB, see Removing a Booth ticket.
Jira:RHEL-12709, Jira:RHEL-7602
Support for new Ha Cluster Management features
For RHEL 10, the pcsd
Web UI is now available as a RHEL web console add-on as the HA Cluster Management application. It is no longer operated as a standalone interface. The HA Cluster Management application now supports the following features:
-
When you set the
placement-strategy
cluster property todefault
, the HA Cluster Management application displays a warning near the utilization attributes for nodes and resources. This warning notes that the utilization has no effect due toplacement-strategy
configuration. - The HA Cluster Management application supports dark mode, which you can set through the user menu in the masthead.
Jira:RHEL-38493[1], Jira:RHEL-38496
6.13. Dynamic programming languages, web and database servers
Python 3.12 in RHEL 10
Python 3.12 is the default Python implementation in RHEL 10. Python 3.12 is distributed as a non-modular python3
RPM package in the BaseOS repository and is usually installed by default. Python 3.12 will be supported for the whole life cycle of RHEL 10.
Additional versions of Python 3 will be distributed as RPM packages with a shorter life cycle through the AppStream repository and will be installable in parallel. The python
command (/usr/bin/python
), as well as other Python-related commands, such as pip
, are available in the unversioned form and point to the default Python 3.12 version.
Notable enhancements compared to the previously released Python 3.11 include:
-
Python introduces a new
type
statement and new type parameter syntax for generic classes and functions. - Formatted string literal (f-strings) have been formalized in the grammar and can now be integrated into the parser directly.
- Python now provides a unique per-interpreter global interpreter lock (GIL).
- You can now use the buffer protocol from Python code.
-
Dictionary, list, and set comprehensions in
CPython
are now inlined. This significantly increases the speed of a comprehension execution. -
CPython
now supports the Linuxperf
profiler. -
CPython
now provides stack overflow protection on supported platforms. -
Python 3.12 is compiled with GCC’s
-O3
optimization flag, which has been used by default in upstream. As a result, you can observe increased performance of your Python applications and the interpreter.
To install packages from the Python 3.12 stack, you can use, for example, the following commands:
dnf install python3 dnf install python3-pip
# dnf install python3
# dnf install python3-pip
To run the interpreter, you can use, for example, the following commands:
python python3 python3 -m pip --help
$ python
$ python3
$ python3 -m pip --help
Jira:RHELDOCS-18402[1], Jira:RHEL-45315
RHEL 10 introduces Perl 5.40
RHEL 10 includes Perl 5.40, which provides various enhancements over the previously available version 5.32.
Core enhancements:
- Perl now supports Unicode 15.0.
-
You can now use a new
-g
command-line option, which is an alias for the umask option-0777
. -
The
-M
command-line option now accepts a space. -
A new
builtin
module now provides documentation for new always-present functions. -
A new
try/catch
feature has been added. - Deprecation warnings now have specific subcategories to provide finer-grained control. Note that you can still disable all deprecation warnings in a single statement.
-
The
@INC
hooks have been enhanced, including the$INC
variable and the newINCDIR
method. -
Forbidden control flow out of the
defer
andfinally
modules is now detected at compile-time. -
The use of
(?{ … })
and(??{ … })
in a pattern now disables various optimisations globally in that pattern. -
The limit for the
REG_INF
regex engine quantifier has been increased from 65,536 to 2,147,483,647. -
A new regexp variable
${^LAST_SUCCESSFUL_PATTERN}
allows access to the last successful pattern that matched in the current scope. -
A new
__CLASS__
keyword has been introduced. -
Perl now supports a new
^^
logical XOR operator.
Incompatible changes:
-
A physically empty
sort
function now triggers a compile-time error. -
The
readline()
function no longer clears the stream error and EOF flags. -
INIT
blocks no longer run after anexit()
function inside aBEGIN
block. -
Calling the
import
method on an unknown package now produces a warning. -
The
return
function no longer allows an indirect object. - Changes in errors and warnings can now cause failures in tests.
-
A physically empty
Deprecations:
-
The use of the
'
character as a package name separator is deprecated. -
The
switch
feature and the smartmatch operator~~
are deprecated. -
Using the
goto
function to jump from an outer scope into an inner scope is deprecated.
-
The use of the
Internal changes:
- Multiple deprecated C functions have been removed.
-
Internal C API functions are now hidden with the
__attribute__((hidden))
attribute on the platforms that support it. This means they are no longer callable from XS modules on those platforms.
Modules:
-
The
Term::Table
andTest2::Suite
modules have been added to Perl Core. - Most modules have been updated.
-
The
For more information, see the perl5340delta
, perl5360delta
, perl5380delta
, and perldelta
man pages.
Jira:RHELDOCS-18869[1]
RHEL 10 introduces Ruby 3.3
RHEL 10 includes Ruby 3.3.7. This version provides a number of performance improvements, bug and security fixes, and new features:
Notable enhancements include:
-
You can use the new
Prism
parser instead ofRipper
.Prism
is a portable, error tolerant, and maintainable recursive descent parser for the Ruby language. - YJIT, the Ruby just-in-time (JIT) compiler implementation, is no longer experimental and it provides major performance improvements.
-
The
Regexp
matching algorithm has been improved to reduce the impact of potential Regular Expression Denial of Service (ReDoS) vulnerabilities. - The new experimental RJIT (a pure-Ruby JIT) compiler replaces MJIT. Use YJIT in production.
- A new M:N thread scheduler is now available.
Other notable changes:
-
You must now use the
Lrama
LALR parser generator instead ofBison
. - Several deprecated methods and constants have been removed.
-
The
Racc
gem has been promoted from a default gem to a bundled gem.
To install Ruby 3.3, enter:
dnf install ruby
# dnf install ruby
For information about the length of support of Ruby 3.3, see Red Hat Enterprise Linux Application Streams Life Cycle.
Jira:RHELDOCS-19658[1]
RHEL 10 provides Node.js 22
RHEL 10 is distributed with Node.js 22
. This version provides numerous new features, bug fixes, security fixes, and performance improvements over previously available Node.js 20
.
Notable changes include:
-
The
V8
JavaScript engine has been upgraded to version 12.4. -
The
V8 Maglev
compiler is now enabled by default on architectures where it is available (AMD and Intel 64-bit architectures and the 64-bit ARM architecture). -
Maglev
improves performance for short-lived CLI programs. -
The
npm
package manager has been upgraded to version 10.8.1. -
The
node --watch
mode is now considered stable. Inwatch
mode, changes in watched files cause theNode.js
process to restart. -
The browser-compatible implementation of
WebSocket
is now considered stable and enabled by default. As a result, a WebSocket client to Node.js is available without external dependencies. -
Node.js
now includes an experimental feature for execution of scripts frompackage.json
. To use this feature, execute thenode --run <script-in-package.json>
command.
To install Node.js 22 enter:
dnf install nodejs
# dnf install nodejs
RHEL 10 introduces PostgreSQL 16
RHEL 10 is distributed with PostgreSQL version 16.
Notable enhancements include:
- The enhanced bulk loading improves the performance.
-
The new
load_balance_hosts
option in thelibpq
library supports more efficient load balancing. -
Configuration files in the
/var/lib/pgsql/data/
directory support including custompg_hba.conf
andpg_ident.conf
files. -
The
/var/lib/pgsql/data/pg_hba.conf
file supports regular expression matching on database and role entries.
Other changes include:
-
Absence of the
postmaster
binary. Use thepostgres
binary instead. This change affects only user who usepostmaster
to start the service. - Absence of the PDF documentation within the package. Use the upstream documentation instead.
For more information, see Using PostgreSQL.
To install PostgreSQL 16, enter:
dnf install postgresql16
# dnf install postgresql16
RHEL 10 introduces MySQL 8.4
RHEL 10 is distributed with MySQL 8.4. Notable changes over the previously available version 8.0 include:
-
The deprecated
mysql_native_password
authentication plug-in is no longer enabled by default. -
When upgrading to MySQL 8.4, user accounts or roles that have the
BINLOG_ADMIN
privilege are automatically granted theTRANSACTION_GTID_TAG
privilege. -
When you install MySQL 8.4, the
mysql_upgrade_history
file is created or updated in the server’s data directory. The file is in JSON format and includes information about the version installed, date and time of installation, and whether the release was part of a Long-Term Support (LTS series) or an Innovation series. -
The use of the
%
and_
characters as wildcards in database grants has been deprecated, and the wildcard functionality will be removed in a future MySQL release. These characters will be treated as literals. They are already treated as literals when thepartial_revokes
server system variable is set toON
. -
The treatment of the
%
character by the server as a synonym for localhost when checking privileges has been deprecated. -
The deprecated
--ssl
and--admin-ssl
server options andhave_ssl
andhave_openssl
server system variables have been removed. Use the--tls-version
and--admin-tls-version
server system variables instead. -
The deprecated
default_authentication_plugin
system variable has been removed. Use theauthentication_policy
server system variable instead. -
The deprecated
SET_USER_ID
privilege has been removed. Instead, you can use theSET_ANY_DEFINER
privilege for definer object creation and theALLOW_NONEXISTENT_DEFINER
privileges for orphan object protection. -
The deprecated
mysql_upgrade
utility has been removed.
For more information, see the upstream MySQL documentation.
RHEL 10 provides PostgreSQL 16 with the pgvector
extension
RHEL 10 is distributed with PostgreSQL 16. In addition to the pgaudit
, pg_repack
, and decoderbufs
extensions, the Postgresql stack now provides the pgvector
extension. With the pgvector
extension, you can store and query high-dimensional vector embeddings directly within PostgreSQL databases and perform a vector similarity search. Vector embeddings are numerical representations of data that are often used in machine learning and AI applications to capture the semantic meaning of text, images, or other data types.
Jira:RHEL-35993[1]
RHEL 10 introduces MariaDB 10.11
RHEL 10 is distributed with MariaDB 10.11. Notable changes include:
- A new sys_schema feature.
- Atomic Data Definition Language (DDL) statements.
- A new GRANT … TO PUBLIC privilege.
- Separate SUPER and READ ONLY ADMIN privileges.
- A new UUID database data type.
- Support for the Secure Socket Layer (SSL) protocol version 3; the MariaDB server now requires correctly configured SSL to start.
- Support for the natural sort order through the natural_sort_key() function.
- A new SFORMAT function for arbitrary text formatting.
- Changes to the UTF-8 charset and the UCA-14 collation.
- systemd socket activation files available in the /usr/share/ directory. Note that they are not a part of the default configuration in RHEL as opposed to upstream.
- Error messages containing the MariaDB string instead of MySQL.
- Error messages available in the Chinese language.
- Changes to the default logrotate file.
-
For MariaDB and MySQL clients, the connection property specified on the command line (for example,
--port=3306
), now forces the protocol type of communication between the client and the server, such as tcp, socket, pipe, or memory.
Jira:RHELDOCS-19550[1]
6.14. Compilers and development tools
RHEL 10 introduces GCC 14.2
RHEL 10 is distributed with the GNU Compiler Collection (GCC) version 14.2.
Notable changes since GCC 13 include:
- Optimization and diagnostic improvements
-
A new
-fhardened
umbrella option, which enables a set of hardening flags -
A new
-fharden-control-flow-redundancy
option to detect attacks that transfer control into the middle of functions -
A new
strub
type attribute to control stack scrubbing properties of functions and variables -
A new
-finline-stringops
option to force inline expansion of certainmem*
functions - Support for new OpenMP 5.1, 5.2, and 6.0 features
- Several new C23 features
- Multiple new C++23 and C++26 features
- Several resolved C++ defect reports
- New and improved experimental support for C++20, C++23, and C++26 in the C++ library
- Support for new CPUs in the 64-bit ARM architecture
- Multiple new instruction set architecture (ISA) extensions in the 64-bit Intel architecture, for example: AVX10.1, AVX-VNNI-INT16, SHA512, and SM4
- New warnings in the GCC’s static analyzer
- Certain warnings changed to errors; for details, see Porting to GCC 14
- Various bug fixes
For more information about changes in GCC 14, see the upstream GCC release notes.
GCC 14 defaults to x86-64-v3
GCC 14 in RHEL 10 defaults to the x86-64-v3 microarchitecture level. This level enables certain capabilities by default, such as the AVX and AVX2 instruction sets and the fused multiply-add (FMA) instruction set. See the related article for more details.
GCC defaults to using the IEEE128
floating point format on IBM Power Systems
In RHEL10, GCC uses the IEEE128
floating point format by default for all long double floating point numbers on IBM Power Systems instead of the earlier software-only IBM-DOUBLE-DOUBLE
code. As a result, you can notice performance improvements in C or C++ code that performs computations by using long double floating point numbers.
Note that this 128-bit long double floating point ABI is incompatible with the floating point ABI used in RHEL 8 and earlier versions. Support for hardware instructions to perform IEEE128
operations is available since IBM POWER9.
Jira:RHEL-24760[1]
GCC 14 supports the FUJITSU-MONAKA CPU
Starting with RHEL 10.0, the GNU Compiler Collection (GCC) supports the FUJITSU-MONAKA. As a result, you can use the -mcpu=fujitsu-monaka
command-line option to create code for this platform.
Jira:RHEL-65765[1]
GCC 14 supports the POWER 11 architecture
Starting with RHEL 10.0, the GNU Compiler Collection (GCC) supports the POWER 11 architecture. As a result, you can use the -mcpu=power11
command-line option to create code for POWER 11.
Jira:RHEL-24762[1]
RHEL 10 includes annobin
version 12.55
RHEL 10 is distributed with annobin
version 12.55. Notable changes over the previously available version 12.32 include:
- Updated tools to build and work with newer versions of the GCC, Clang, LLVM, and Go compilers
-
Recording and testing for the use of the GCC command-line options
-Wimplicit-int
and-Wimplicit-function-declaration
- Improved support for LLVM
- New tests
- A new check to identify if the deprecated OpenSSL Engine code is used
-
Multiple
--debug-rpm
options are now supported - Various bug fixes
Jira:RHEL-526[1]
RHEL 10 includes binutils
version 2.41
RHEL 10 is distributed with binutils
version 2.41. Notable changes over the previously available version 2.40 include:
-
binutils
tools support architecture extensions in the 64-bit Intel and ARM architectures. -
The linker now accepts the
--remap-inputs <PATTERN>=<FILE>
command-line option to replace any input file that matches<PATTERN>
with<FILE>
. In addition, you can use the--remap-inputs-file=<FILE>
option to specify a file containing any number of these remapping directives. -
For ELF targets, you can use the linker command-line option
--print-map-locals
to include local symbols in a linker map. -
For most ELF-based targets, you can use the
--enable-linker-version
option to insert the version of the linker as a string into the.comment
section. -
The linker script syntax has a new command for output sections,
ASCIZ "<string>"
, which inserts a zero-terminated string at the current location. -
You can use the new
-z nosectionheader
linker command-line option to omit ELF section header.
Jira:RHELDOCS-18761[1]
GCC can generate ROP protection instructions for Power 10 or later
The IBM Power 10 and later platforms have a protection against Return-Oriented Programming (ROP), which is a common primitive used to exploit vulnerabilities in programs. With this enhancement, you can use the {{-mrop-protect}}
flag and GCC creates ROP protection instructions for these platforms. Note that, because there is no runtime support, the generated instructions have currently no effect, and the CPU treats them as no operation (NOP) instructions. However, developers can use the {{-mrop-protect}}
flag to incorporate ROP protection mechanisms so that, in future, when ROP protection is enabled for these platforms, the applications will be more secure.
Jira:RHEL-36791[1]
binutils
now supports the arch15
extension of the IBM Z instruction set
With this enhancement, binutils
supports the arch15
extensions of CPUs on the IBM Z platform. Developers can now use the new features provided by the arch15
extension in assembler source files or, when an updated compiler is available, also in compiled programs. This can result in smaller and faster programs.
Jira:RHEL-56896[1]
The ld
linker of binutils
supports the --section-ordering-file
option
You can now use the new --section-ordering-file
command-line option with ld.bfd
, the default system linker, to group sections of code or data that can benefit from being in proximity to each other.
This feature improves performance of programs by reducing cache misses. You can use profiling tools to analyze use of your program’s code over time, and then improve code grouping in the executable image. As a result, you have more control over the layout of your programs in memory.
The --section-ordering-file
option also enhances compatibility with the gold
and lld
linkers, which already provide this feature.
For details, see the blog post A practical guide to linker section ordering.
glibc
now supports dynamic linking of Intel APX-enabled functions
An incompatible dynamic linker trampoline was identified as a potential source of incompatibilities for Intel Advanced Performance Extensions (APX) applications. As a workaround, it was possible to use the BIND_NOW
executable or use only the standard calling convention. With this update, the dynamic linker of glibc
preserves APX-related registers.
Because of this change, additional space is needed beyond the top of the stack. Users who strictly limit this space might need to adjust or evaluate the stack limits.
RHEL 10 provides glibc
version 2.39
RHEL 10 introduces GNU C Library (glibc
) version 2.39.
Optimization of AMD Zen 3 and Zen 4 performance in glibc
Previously, AMD Zen 3 and Zen 4 processors sometimes used the Enhanced Repeat Move String (ERMS) version of the memcpy
and memmove
library routines regardless of the most optimal choice. With this update to glibc
, AMD Zen 3 and Zen 4 processors use the most optimal versions of memcpy
and memmove
.
RHEL 10 provides GDB version 14.2
GDB has been updated to version 14.2. The following paragraphs list notable changes since GDB 12.1.
General:
-
The
info breakpoints
command now displays enabled breakpoint locations of disabled breakpoints as in they-
state. -
Added support for debug sections compressed with Zstandard (
ELFCOMPRESS_ZSTD
) for ELF. -
The Text User Interface (TUI) no longer styles the source and assembly code highlighted by the current position indicator by default. To re-enable styling, use the new command
set style tui-current-position
. -
A new
$_inferior_thread_count
convenience variable contains the number of live threads in the current inferior. -
For breakpoints with multiple code locations, GDB now prints the code location using the
<breakpoint_number>.<location_number>
syntax. -
When a breakpoint is hit, GDB now sets the
$_hit_bpnum
and$_hit_locno
convenience variables to the hit breakpoint number and code location number. You can now disable the last hit breakpoint by using thedisable $_hit_bpnum
command, or disable only the specific breakpoint code location by using thedisable $_hit_bpnum.$_hit_locno
command. -
Added support for the
NO_COLOR
environment variable. - Added support for integer types larger than 64 bits.
-
You can use new commands for multi-target feature configuration to configure remote target feature sets (see the
set remote <name>-packet
andshow remote <name>-packet
in Commands). - Added support for the Debugger Adapter Protocol.
-
You can now use the new
inferior
keyword to make breakpoints inferior-specific (seebreak
orwatch
in Commands). -
You can now use the new
$_shell()
convenience function to execute a shell command during expression evaluation.
Changes to existing commands:
break
,watch
-
Using the
thread
ortask
keywords multiple times with thebreak
andwatch
commands now results in an error instead of using the thread or task ID of the last instance of the keyword. -
Using more than one of the
thread
,task
, andinferior
keywords in the samebreak
orwatch
command is now invalid.
-
Using the
printf
,dprintf
-
The
printf
anddprintf
commands now accept the%V
output format, which formats an expression the same way as theprint
command. You can also modify the output format by using additional print options in brackets[…]
following the command, for example:printf "%V[-array-indexes on]", <array>
.
-
The
list
-
You can now use the
.
argument to print the location around the point of execution in the current frame, or around the beginning of themain()
function if the inferior has not started yet. -
Attempting to list more source lines in a file than are available now issues a warning, referring the user to the
.
argument.
-
You can now use the
document user-defined
- It is now possible to document user-defined aliases.
New commands:
-
set print nibbles [on|off]
(default:off
),show print nibbles
- controls whether theprint/t
command displays binary values in groups of four bits (nibbles). -
set debug infcall [on|off]
(default:off
),show debug infcall
- prints additional debug messages about inferior function calls. -
set debug solib [on|off]
(default:off
),show debug solib
- prints additional debug messages about shared library handling. -
set print characters <LIMIT>
,show print characters
,print -characters <LIMIT>
- controls how many characters of a string are printed. -
set debug breakpoint [on|off]
(default:off
),show debug breakpoint
- prints additional debug messages about breakpoint insertion and removal. -
maintenance print record-instruction [ N ]
- prints the recorded information for a given instruction. -
maintenance info frame-unwinders
- lists the frame unwinders currently in effect in the order of priority (highest first). -
maintenance wait-for-index-cache
- waits until all pending writes to the index cache are completed. -
info main
- prints information on the main symbol to identify an entry point into the program. -
set tui mouse-events [on|off]
(default:on
),show tui mouse-events
- controls whether mouse click events are sent to the TUI and Python extensions (whenon
), or the terminal (whenoff
).
Machine Interface (MI) changes:
- MI version 1 has been removed.
-
MI now reports
no-history
when reverse execution history is exhausted. -
The
thread
andtask
breakpoint fields are no longer reported twice in the output of the-break-insert
command. - Thread-specific breakpoints can no longer be created on non-existent thread IDs.
-
The
--simple-values
argument to the-stack-list-arguments
,-stack-list-locals
,-stack-list-variables
, and-var-list-children
commands now considers reference types as simple if the target is simple. -
The
-break-insert
command now accepts a new-g thread-group-id
option to create inferior-specific breakpoints. -
Breakpoint-created notifications and the output of the
-break-insert
command can now include an optionalinferior
field for the main breakpoint and each breakpoint location. -
The async record stating the
breakpoint-hit
stopped reason now contains an optional fieldlocno
giving the code location number in case of a multi-location breakpoint.
Changes in the GDB Python API:
Events
-
A new
gdb.ThreadExitedEvent
event. -
A new
gdb.executable_changed
event registry, which emits theExecutableChangedEvent
objects that haveprogspace
andreload
attributes. -
New
gdb.events.new_progspace
andgdb.events.free_progspace
event registries, which emit theNewProgpspaceEvent
andFreeProgspaceEvent
event types. Both of these event types have a single attributeprogspace
to specify thegdb.Progspace
program space that is being added to or removed from GDB.
-
A new
The
gdb.unwinder.Unwinder
class-
The
name
attribute is now read-only. -
The name argument of the
__init__
function must be of thestr
type, otherwise aTypeError
is raised. -
The
enabled
attribute now accepts only thebool
type.
-
The
The
gdb.PendingFrame
class-
New methods:
name
,is_valid
,pc
,language
,find_sal
,block
, andfunction
, which mirror similar methods of thegdb.Frame
class. -
The
frame-id
argument of thecreate_unwind_info
function can now be either an integer or agdb.Value
object for thepc
,sp
, andspecial
attributes.
-
New methods:
-
A new
gdb.unwinder.FrameId
class, which can be passed to thegdb.PendingFrame.create_unwind_info
function. -
The
gdb.disassembler.DisassemblerResult
class can no longer be sub-classed. -
The
gdb.disassembler
module now includes styling support. -
A new
gdb.execute_mi(COMMAND, [ARG]…)
function, which invokes a GDB/MI command and returns result as a Python dictionary. -
A new
gdb.block_signals()
function, which returns a context manager that blocks any signals that GDB needs to handle. -
A new
gdb.Thread
subclass of thethreading.Thread
class, which calls thegdb.block_signals
function in itsstart
method. -
The
gdb.parse_and_eval
function has a newglobal_context
parameter to restrict parsing on global symbols. The
gdb.Inferior
class-
A new
arguments
attribute, which holds the command-line arguments to the inferior, if known. -
A new
main_name
attribute, which holds the name of the inferior’smain
function, if known. -
New
clear_env
,set_env
, andunset_env
methods, which can modify the inferior’s environment before it is started.
-
A new
The
gdb.Value
class-
A new
assign
method to assign a value of an object. -
A new
to_array
method to convert an array-like value to an array.
-
A new
The
gdb.Progspace
class-
A new
objfile_for_address
method, which returns thegdb.Objfile
object that covers a given address (if exists). -
A new
symbol_file
attribute holding thegdb.Objfile
object that corresponds to theProgspace.filename
variable (orNone
if the filename isNone
). -
A new
executable_filename
attribute, which holds the string with a filename that is set by theexec-file
orfile
commands, orNone
if no executable file is set.
-
A new
The
gdb.Breakpoint
class-
A new
inferior
attribute, which contains the inferior ID (an integer) for breakpoints that are inferior-specific, orNone
if no such breakpoints are set.
-
A new
The
gdb.Type
class-
New
is_array_like
andis_string_like
methods, which reflect whether a type might be array- or string-like regardless of the type’s actual type code.
-
New
-
A new
gdb.ValuePrinter
class, which can be used as the base class for the result of applying a pretty-printer. -
A newly implemented
gdb.LazyString.__str__
method. The
gdb.Frame
class-
A new
static_link
method, which returns the outer frame of a nested function frame. -
A new
gdb.Frame.language
method that returns the name of the frame’s language.
-
A new
The
gdb.Command
class-
GDB now reformats the doc string for the
gdb.Command
class and thegdb.Parameter
sub-classes to remove unnecessary leading whitespace from each line before using the string as the help output.
-
GDB now reformats the doc string for the
The
gdb.Objfile
class-
A new
is_file
attribute.
-
A new
-
A new
gdb.format_address(ADDRESS, PROGSPACE, ARCHITECTURE)
function, which uses the same format as when printing address, symbol, and offset information from the disassembler. -
A new
gdb.current_language
function, which returns the name of the current language. -
A new Python API for wrapping GDB’s disassembler, including
gdb.disassembler.register_disassembler(DISASSEMBLER, ARCH)
,gdb.disassembler.Disassembler
,gdb.disassembler.DisassembleInfo
,gdb.disassembler.builtin_disassemble(INFO, MEMORY_SOURCE)
, andgdb.disassembler.DisassemblerResult
. -
A new
gdb.print_options
function, which returns a dictionary of the prevailing print options, in the form accepted by thegdb.Value.format_string
function. The
gdb.Value.format_string
function-
gdb.Value.format_string
now uses the format provided by theprint
command if it is called during aprint
or other similar operation. -
gdb.Value.format_string
now accepts thesummary
keyword.
-
-
A new
gdb.BreakpointLocation
Python type. -
The
gdb.register_window_type
method now restricts the set of acceptable window names.
Architecture-specific changes:
AMD and Intel 64-bit architectures
-
Added support for disassembler styling using the
libopcodes
library, which is now used by default. You can modify how the disassembler output is styled by using theset style disassembler *
commands. To use the Python Pygments styling instead, use the newmaintenance set libopcodes-styling off
command.
-
Added support for disassembler styling using the
The 64-bit ARM architecture
- Added support for dumping memory tag data for the Memory Tagging Extension (MTE).
- Added support for the Scalable Matrix Extension 1 and 2 (SME/SME2). Some features are still considered experimental or alpha, for example, manual function calls with ZA state or tracking Scalable Vector Graphics (SVG) changes based on DWARF.
- Added support for Thread Local Storage (TLS) variables.
- Added support for hardware watchpoints.
The 64-bit IBM Z architecture
-
Record and replay support for the new
arch14
instructions on IBM Z targets, except for the specialized-function-assist instructionNNPA
.
-
Record and replay support for the new
IBM Power Systems, Little Endian
- Added base enablement support for POWER11.
For changes since the RHEL 9 system version of GDB 10.2, see the release notes for the GCC Toolset 12 version of GDB 11.2 and the GCC Toolset 13 version of GDB 12.1.
Jira:RHEL-33256, Jira:RHEL-39324, Jira:RHEL-24764
RHEL 10 provides elfutils
version 0.191
The elfutils
package has been updated to version 0.191. Notable improvements include:
Changes in the
libdw
library:-
The
dwarf_addrdie
function now supports binaries lacking adebug_aranges
section. - Support for DWARF package files has been improved.
-
A new
dwarf_cu_dwp_section_info
function has been added.
-
The
-
Caching eviction logic in the
debuginfod
server has been enhanced to improve retention of small, frequent, or slow files, such asvdso.debug
. -
The
eu-srcfiles
utility can now fetch the source files of a DWARF/ELF file and place them into azip
archive.
RHEL 10 provides SystemTap
version 5.1
RHEL 10 includes the SystemTap
tracing and probing tool version 5.1. Notable changes since version 5.0 include:
-
An experimental
--build-as=USER
flag to reduce privileges during script compilation. - Improved support for probing processes running in containers, identified by host PID.
- New probes for userspace hardware breakpoints and watchpoints.
-
Support for the
--remote
operation of--runtime=bpf
mode. - Improved robustness of kernel-user transport.
RHEL 10 provides Valgrind
version 3.23.0
The Valgrind
suite has been updated to version 3.23.0. Notable enhancements include:
-
The
--track-fds=yes
option now warns against double closing of file descriptors, generates suppressible errors, and supports XML output. -
The
--show-error-list=no|yes
option now accepts a new value,all
, to also print the suppressed errors. -
On the 64-bit IBM Z architecture,
Valgrind
now supports neural network processing assist (NNPA) facility vector instructions:VCNF
,VCLFNH
,VCFN
,VCLFNL
,VCRNF
, andNNPA
(z16/arch14). -
On the 64-bit ARM architecture,
Valgrind
now supportsdotprod
instructions (sdot/udot
). -
On the AMD and Intel 64-bit architectures,
Valgrind
now provides more accurate instruction support for the x86_64-v3 microarchitecture. -
Valgrind
now provides wrappers for thewcpncpy
,memccpy
,strlcat
, andstrlcpy
functions that can detect memory overlap. -
Valgrind
now supports the following Linux syscalls:mlock2
,fchmodat2
, andpidfd_getfd
.
RHEL 10 introduces Dyninst
version 12.3.0
RHEL 10 is distributed with the Dyninst
library version 12.3.0.
Jira:RHEL-49597[1]
SystemTap
provided in version 5.2
RHEL 10.0 provides the SystemTap
tracing and probing tool in version version 5.2.
A notable enhancement is the full activation of debuginfod-metadata
based probes, based on elfutils
0.192. With this feature, you can write a systemtap
script to target a full range of versions of a given binary or library by searching a debuginfod
server for all matching names.
RHEL 10 introduces debugedit
5.1
RHEL 10 is distributed with debugedit
5.1. The most notable changes are:
-
The
debugedit
utility now uses the fasterxxhash
algorithm to generate thebuildid
. -
The
find-debuginfo
utility supports the following new options: -
-v
and--verbose
to add more output for all files processed -
-q
and--quiet
to silence all non-error output -
The
find-debuginfo
utility now passes the-j
option also to thedwz
tool, which enables parallelized processing. -
The
debugedit
utility now handles compressed DWARF debugging ELF sections. -
The
debugedit
utility now handles more DWARF5 constructs as used by theclang
compiler.
RHEL 10 provides elfutils version 0.192
The elfutils
package has been updated to version 0.192. Notable improvements include:
debuginfod
:- Added per-file signature verification for integrity checking, by using the RPM IMA scheme from Fedora and RHEL.
-
New API for metadata queries: file name →
buildid
. -
The server-side extraction of files from kernel
debuginfo
packages is significantly faster. It takes now less than 0.25 seconds, down from ~50 seconds.
libdw
:-
New functions
dwfl_set_sysroot
,dwfl_frame_unwound_source
, anddwfl_unwound_source_str
.
-
New functions
stacktrace
:-
Experimental new tool that can process a stream of stack samples from the
Sysprof
profiler and unwind them into call chains. Enable on x86 with--enable-stacktrace
. See theREADME.eu-stacktrace
file in the development branch for detailed usage instructions. -
The
eu-stacktrace
utility is available as a Technology Preview. For details, seeeu-stacktrace
available as a Technology Preview.
-
Experimental new tool that can process a stream of stack samples from the
RHEL 10 provides libabigail
2.6
RHEL 10 provides version 2.6 of the libabigail
library. Notable changes include:
- Better support for Linux kernel module analysis by using the BPF Type Format (BTF) and Common Trace Format (CTF).
- Improved internal type comparison algorithms in the middle end.
-
Improved logging in
abipkgdiff
,abidw
, andabilint
utilities - Numerous bug fixes.
For further changes, see the upstream release notes.
valgrind
provided in version 3.24.0
RHEL 10.0 provides the valgrind
suite in version 3.24.0. Notable enhancements include:
-
The
--track-fds=yes
option now shows suppressible errors when using bad file descriptors, and the errors are written to the XML output. The warnings shown, if you do not use the option, are deprecated and will be removed in a future version. - Error messages now support Ada name demangling.
-
The
deflate-conversion
facility (z15/arch13) now supports the deflate compression call (DFLTCC) instruction on the IBM Z platform. -
On the IBM Z platform,
valgrind
now supports the instructions provided by the message security assist (MSA) facility and its 1-9 extensions. Valgrind
now supports the following new Linux system calls:-
open_tree
-
move_mount
-
fsopen
-
fsconfig
-
fsmount
-
fspick
-
landlock_create_ruleset
-
landlock_add_rule
-
landlock_restrict_self
-
Go Toolset provided in version 1.23
RHEL 10.0 provides Go Toolset in version 1.23. Notable enhancements include:
The
for-range
loop accepts iterator functions of the following types:-
func(func() bool)
-
func(func(K) bool)
func(func(K, V) bool)
Calls of the iterator argument function create the iteration values for the
for-range
loop. For reference links, see the upstream release notes.
-
- The Go Toolchain can collect usage and breakage statistics to help the Go team to understand how the Go Toolchain is used and working. By default, Go Telemetry does not upload telemetry data and stores it only locally. For further information, see the upstream Go Telemetry documentation.
-
The
go vet
sub-command includes thestdversion
analyzer which flags references to symbols that are too new for the version of Go you use in the referring file. -
The
cmd
andcgo
features support the-ldflags
option to pass flags to the C linker. Thego
command uses this flag automatically to avoidargument list too long
errors when you use a very largeCGO_LDFLAGS
environment variable. -
The
trace
utility tolerates partially broken traces and attempts to recover the trace data. This is especially useful in case of crashes, because you can get the trace leading up to the crash. -
The traceback printed by the runtime after an unhandled panic or other fatal error carries indentation to distinguish the stack trace of the
goroutine
from the firstgoroutine
. - The compiler build time overhead of using profile-guided optimization was reduced to single-digit percentage.
-
The new
-bindnow
linker flag enables immediate function binding when building a dynamically-linked ELF binary. -
The
//go:linkname
linker directive no longer refer to internal symbols in the standard library and the runtime that are not marked with//go:linkname
on their definition. -
If a program no longer refers to a
Timer
orTicker
, garbage collection cleans them up immediately even if theirStop
method has not been called. The timer channel associated with aTimer
orTicker
is now unbuffered with capacity 0. This ensures that, every time aReset
orStop
method is called, no stale values are not sent or received after the call. -
The new
unique
package provides facilities for canonicalizing values, such asinterning
orhash-consing
. -
The new
iter
package provides the basic definitions to work with user-defined iterators. -
The
slices
andmaps
packages introduce several new functions that work with iterators. -
The new
structs
package provides types for struct fields that modify properties of the containing struct type, such as memory layout. Minor changes are made in the following packages:
-
archive/tar
-
crypto/tls
-
crypto/x509
-
database/sql
-
debug/elf
-
encoding/binary
-
go/ast
-
go/types
-
math/rand/v2
-
net
-
net/http
-
net/http/httptest
-
net/netips
-
path/filepath
-
reflect
-
runtime/debug
-
runtime/pprof
-
runtime/trace
-
slices
-
sync
-
sync/atomic
-
syscall
-
testing/fstest
-
text/template
-
time
-
unicode/utf16
-
For more information, see the upstream release notes.
Go Toolset is a rolling Application Stream, and Red Hat supports only the latest version. For more information, see the Red Hat Enterprise Linux Application Streams Life Cycle document.
RHEL 10 introduces LLVM Toolset 19.1.7
RHEL 10 is distributed with the LLVM Toolset version 19.1.7.
Notable changes of the LLVM compiler:
- LLVM now uses debug records, a more efficient representation for debug information.
Notable updates of the Clang:
- C++14 sized deallocation is now enabled by default.
- C++17 support has been completed.
- Improvements to C++20 support, especially around modules, concepts, and Class Template Argument Deduction (CTAD) have been added.
- Improvements to C++23, C++2c, C23, and C2y support have been added.
For more information, see the LLVM release notes and Clang release notes.
LLVM Toolset is a rolling Application Stream, and only the latest version is supported. For more information, see the Red Hat Enterprise Linux Application Streams Life Cycle document.
RHEL 10.0 includes Rust Toolset version 1.84.1
RHEL 10.0 is distributed with the Rust Toolset version 1.84.1. Notable enhancements since the previously available version 1.79.0 include:
-
The new
LazyCell
andLazyLock
types delay the initialization until the first use. These extend the earlierOnceCell
andOnceLock
types with the initialization function included in each instance. - The new sort implementations in the standard library improve the runtime performance and compile times. They also try to detect cases where a comparator is not producing a total order, making that panic instead of returning unsorted data.
-
Precise capturing for opaque return types have been added. The new
use<..>
syntax specifies the generic parameters and lifetimes used in animpl Trait
return type. Many new features for
const
code have been added, for example:- Floating point support
-
const
immediates for inline assembly - References to statics
- Mutable reference and pointers
Many new features for
unsafe
code have been added, for example:- Strict provenance APIs
-
&raw
pointer syntax - Safely addressing statics
-
Declaring safe items in unsafe
extern
blocks
-
The Cargo dependency resolver is now version aware. If a dependency crate specifies its minimum supported Rust version, Cargo uses this information when it resolves the dependency graph instead of using the latest
semver
-compatible crate version.
Compatibility notes:
-
The WebAssembly System Interface (WASI) target is changed from
rust-std-static-wasm32-wasi
torust-std-static-wasm32-wasip1
. You can select the WASI target also by using the--target wasm32-wasip1
parameter on the command line. For more information, see the Changes to Rust’s WASI targets upstream blog post. -
The split panic hook and panic handler arguments
core::panic::PanicInfo
andstd::panic::PanicInfo
are now different types. -
extern "C"
functions now abort on uncaught panics. Useextern "C-unwind"
instead to allow unwinding across ABI boundaries.
Rust Toolset is a rolling Application Stream, and Red Hat only supports the latest version. For more information, see the Red Hat Enterprise Linux Application Streams Life Cycle document.
Jira:RHEL-59689[1]
RHEL 10 includes PCP version 6.3.0
RHEL 10 is distributed with Performance Co-Pilot (PCP) version 6.3.0. Notable changes over the previously available version 6.2.0 include:
New tools and agents
-
pcp2openmetrics
: a new tool to push PCP metrics in Open Metrics format to remote end points -
pcp-geolocate
: a new tool to report latitude and longitude metric labels -
pmcheck
: a new tool to interrogate and control PCP components -
pmdauwsgi
: a new PCP agent that exports instrumentation from uWSGI servers
Enhanced tools
-
pmdalinux
: added new kernel metrics (hugepages, filesystems, TCP, softnet, virtual machine balloon) -
pmdalibvirt
: added support for metric labels, added new balloon, vCPU, and domain info metrics -
pmdabpf
: improved eBPF networking metrics for use with thepcp-atop
utility
Jira:RHELDOCS-18787[1]
RHEL 10 provides Grafana
version 10.2.6
The Grafana
platform has been updated to version 10.2.6.
Notable enhancements include:
- Support for zooming in on the y axis of time series and candlestick visualizations by holding shift while clicking and dragging.
- Streamlined data source selection when creating a dashboard.
- Updated User Interface, including updates to navigation and the command palette.
-
Various improvements to transformations, including the new unary operation mode for the
Add field from calculation
transformation. - Various improvements to dashboards and data visualizations, including a redesigned empty dashboard and dashboard panel.
- New geomap and canvas panels.
Other changes:
- Various improvements to users, access, authentication, authorization, and security.
- Alerting improvements along with new alerting features.
- Public dashboards now available.
For a complete list of changes since the previously available Grafana
version 9.2, see the upstream documentation.
RHEL 10 provides grafana-pcp
in version 5.2.2
RHEL 10 is distributed with the grafana-pcp
plugin version 5.2.2. Notable changes include:
- The plugin now uses Valkey as a data source instead of Redis. As a consequence, the PCP Redis data source was renamed to PCP Valkey.
New dashboards:
- PCP Vector Top Consumers
- PCP Vector UWSGI overview
- The metric search is unavailable until a replacement for the RediSearch module is available for the Valkey data source.
Grafana, PCP, and grafana-pcp
now use Valkey
to store data
In RHEL 10, the Valkey
key-value store replaces Redis
. As a result, Grafana
, PCP, and the grafana-pcp
plug-in now use Valkey
to store data instead of Redis
. The PCP Redis
data source in the grafana-pcp
plug-in is now named PCP Valkey
.
zlib-ng-compat
replaces zlib
in RHEL 10
The new zlib-ng-compat
package provides a general-purpose lossless data compression library that is used by many different programs. This implementation provides various benefits over zlib
distributed in RHEL 9. For example, zlib-ng-compat
supports hardware acceleration when available and enhances compression efficiency and performance. zlib-ng-compat
is built in API and ABI compatible mode to ensure a smooth transition from zlib
.
Jira:RHEL-24058[1]
SWIG 4.3.0 available in the CRB repository
The Simplified Wrapper and Interface Generator (SWIG) version 4.2.1 is now available in the CodeReady Linux Builder (CRB) repository. Notable changes include:
- Python Standard Template Library (STL) container wrappers now use the Python Iterator Protocol.
SWIG now supports:
- Python stable Application Binary Interface (ABI)
- Python 3.12 and Python 3.13
- Ruby 3.2 and Ruby 3.3
- Tcl 9.0
- PHP 8; support for PHP 7 has been removed.
- Support for the C++14 auto variable without trailing return type for the C++11 auto variable has been added.
- Constructors, destructors, and assignment operators have been fixed, including implicit, default, and deleted, and related non-assignable variable wrappers.
- A new Javascript generator targeting Node.js binary stable ABI Node-API is now available.
- Multiple deprecated features have been removed.
- Experimental support for C as a target language has been added.
-
Handling of namespaces when using the
nspace
feature has been enhanced. -
The STL wrapper has been enhanced for the
std::unique_ptr
,std::string_view
,std::filesystem objects
. - Support for C++17 fold expressions and C++11 trailing return types has been added.
- Handling of string and character literals has been improved.
Note that packages included in the CodeReady Linux Builder repository are unsupported.
Jira:RHELDOCS-19059[1]
Red Hat build of OpenJDK 21 is the default Java implementation in RHEL 10
The default RHEL 10 Java implementation is OpenJDK 21. Use the java-21-openjdk
packages, which provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. For more information, see the OpenJDK documentation.
Clang and LLVM now support zstd
for debug section compression
By default, Clang and LLVM tools use Zlib
as the algorithm for debug section compression. With this enhancement, users can alternatively use the Zstandard (zstd
) algorithm which can reach a higher compression rate than Zlib
.
For example, if you want to use zstd
compression when you compile a program with Clang, use the following command:
clang -Wa,-compress-debug-sections=zstd -Wl,--compress-debug-sections=zstd ...
$ clang -Wa,-compress-debug-sections=zstd -Wl,--compress-debug-sections=zstd ...
The llvm-doc
package now contains only a reference to the upstream documentation.
In previous versions, the llvm-doc
package contained the LLVM documentation in HTML format. With this update, the package provides only the /usr/share/doc/llvm/html/index.html
file which contains a reference to the upstream documentation.
RHEL 10 provides cmake
in version 3.30.5
RHEL 10 is distributed with cmake
version 3.30.5. For notable changes, see the upstream release notes.
RHEL 10 provides .NET in versions 9.0 and 8.0
The most recent version of .NET (9.0) and the current long-term support of .NET (8.0), a general-purpose development platform featuring automatic memory management and modern programming languages, are supported on Red Hat Enterprise Linux (RHEL) 10. Using .NET, you can build high-quality applications efficiently.
For details on installation and usage, see the documentation for .NET 9.0 and .NET 8.0.
Jira:RHELDOCS-20066[1]
6.15. Identity Management
RHEL 10 provides python-jwcrypto
version 1.5.6
The python-jwcrypto
package has been updated to version 1.5.6. This version includes a security fix to an issue where an attacker could cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio.
Jira:RHELDOCS-20100[1]
RHEL 10 provides ansible-freeipa
package version 1.14.5
The ansible-freeipa
package has been updated to version 1.14.5. Notable enhancements and bug fixes include:
You can use
module_defaults
to define variables for multipleansible-freeipa
tasksThe
freeipa.ansible_freeipa
collection now provides themodule_defaults
action group that simplifies the use ofansible-freeipa
modules. By usingmodule_defaults
, you can set default values to be applied to all modules of the collection used in a playbook. To do so, use theaction_group
namedfreeipa.ansible_freeipa.modules
. For example:- name: Test hosts: localhost module_defaults: group/freeipa.ansible_freeipa.modules: ipaadmin_password: Secret123 tasks: …
- name: Test hosts: localhost module_defaults: group/freeipa.ansible_freeipa.modules: ipaadmin_password: Secret123 tasks: …
Copy to Clipboard Copied! As a result, the playbook is more concise.
Multiple IdM
sudo
rules can now be managed in a single Ansible taskWith this enhancement in
ansible-freeipa
, you can add, modify, and delete multiple Identity Management (IdM)sudo
rules by using a single Ansible task. To do this, use thesudorules
option of theipasudorule
module. As a result, you can define yoursudo
rules more easily, and execute them more efficiently.Using the
sudorules
option, you can specify multiplesudo
rule parameters that apply to a particularsudo
rule. Thissudo
rule is defined by thename
variable, which is the only mandatory variable for thesudorules
option.Removing external members by using the
ipagroup
module now works correctlyPreviously, attempting to ensure the absence of an external member from an IdM group by using the
ansible-freeipa
ipagroup
module with theexternalmember
parameter did not remove the members from the group, even though Ansible presented the result of the task aschanged
. With this fix, using theipagroup
module withexternalmember
correctly ensures the absence of an external member from an IdM group. The fix also allows the use of either DOM\name or name@domain to identify AD users.
New tool to manage IdM ID range inconsistencies
With this update, Identity Management (IdM) provides the ipa-idrange-fix
tool. You can use ipa-idrange-fix
tool to analyze existing IdM ID ranges, identify users and groups outside these ranges, and propose to create new ipa-local
ranges to include them.
The ipa-idrange-fix
tool performs the following:
- Read and analyze existing ranges from LDAP.
-
Search for users and groups outside of
ipa-local
ranges. -
Propose new
ipa-local
ranges to cover the identified users and groups. - Prompt the user to apply the proposed changes.
By default, the tool excludes IDs below 1000 to prevent conflicts with system accounts. Red Hat strongly recommends creating a full system backup before applying any suggested changes.
For more information, see the ipa-idrange-fix(1)
man page.
Jira:RHEL-56917[1]
Automated removal of expired certificates is enabled by default
With this update, automated removal of expired certificates is now enabled by default in Identity Management (IdM) on new replicas. A prerequisite for this is the generation of random serial numbers for certificates using RSNv3, which is now also enabled by default.
As a result, certificates are now created with random serial numbers and are removed automatically when expired, after a default retention period of 30 days after expiry.
RHEL 10 provides python-pyasn1
version 0.6.1
The python-pyasn1
package has been updated to version 0.6.1. The update includes various enhancements and bug fixes, including:
- Support of Python 3.13
- Removed support of Python 2.7, 3.6, 3.7
- Improved error handling and consistency
- Runtime deprecation of tagMap and typeMap aliases
- Support of the previously missing RELATIVE-OID construct
The ldap_id_use_start_tls
option is now enabled by default
To improve security, the default value for ldap_id_use_start_tls
has changed from false
to true
. When using ldap://
without TLS for identity lookups, it can pose a risk for an attack vector. Particularly a man-in-the-middle (MITM) attack which could allow an attacker to impersonate a user by altering, for example, the UID or GID of an object returned in an LDAP search.
As unencrypted communication is not secure, the default ldap_id_use_start_tls
option is now set to true
.
Jira:RHELDOCS-19185[1]
RHEL 10 provides certmonger
version 0.79.20
The certmonger
package has been updated to version 0.79.20. The update includes various bug fixes and enhancements, most notably:
- Enhanced handling of new certificates in the internal token and improved the removal process on renewal.
-
Removed restrictions on tokens for
CKM_RSA_X_509
cryptographic mechanism. -
Fixed the documentation for the
getcert add-scep-ca
,--ca-cert
, and--ra-cert
options. - Renamed the D-Bus service and configuration files to match canonical name.
-
Added missing
.TP
tags in thegetcert-resubmit
man page. - Migrated to the SPDX license format.
-
Included owner and permissions information in the
getcert list
output. -
Removed the requirement for an NSS database in the
cm_certread_n_parse
function. - Added translations using Webplate for Simplified Chinese, Georgian, and Russian.
Jira:RHEL-40922[1]
RHEL 10 provides python-jwcrypto
in version 1.5.6
The python-jwcrypto
package has been updated to version 1.5.6. This version includes a security fix to an issue where an attacker could cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio.
Jira:RHELDOCS-19191[1]
Kerberos now supports the Elliptic Curve Diffie-Hellman key agreement algorithm
The Elliptic Curve Diffie-Hellman (ECDH) key agreement algorithm for PKINIT, as defined by RFC5349, is now supported. With this update, the pkinit_dh_min_bits
setting in krb5.conf`file can now be configured with `P-256
, P-384
, or P-521
to use ECDH by default.
Jira:RHEL-71881[1]
RHEL 10 provides 389-ds-base
version 3.0.6
The 389-ds-base
package has been updated to version 3.0.6. The update includes various enhancements and bug fixes, including:
- Log buffering for the error log
- An option to write the audit log in JSON format
- An option to defer updating group members when the group is updated
- An option to configure a number of PBKDF2 iterations
-
The
logconv.py
log analyzer tool
389-ds-base
now fully supports LMDB
The Lightning Memory-Mapped Database (LMDB), previously available as a Technology Preview in the 389-ds-base
package, is now fully supported.
Key benefits include:
- LMDB is highly optimized for read operations.
- LMDB avoids memory allocations and memory-to-memory copies.
- LMDB requires minimal configuration.
- LMDB supports multi-threaded and multi-process environments with no deadlocks.
- Readers never block writers, and vice versa.
- LMDB does not require transaction logs.
Starting with RHEL 10, all new Directory Server instances use only LMDB as the database type, and a standard installation with BDB is no longer possible.
To migrate your existing BDB instances to LBDM, create a new LMDB instance and import the database contents by using an LDIF file or replication method.
Directory Server stores LMDB settings under the cn=mdb,cn=config,cn=ldbm database,cn=plugins,cn=config
entry that includes the following new configuration parameters:
nsslapd-mdb-max-size
sets the database maximum size in bytes.Important: Make sure that
nsslapd-mdb-max-size
is large enough to store all intended data. However, the parameter value must not be too high to impact the performance because the database file is memory-mapped.-
nsslapd-mdb-max-readers
sets the maximum number of read operations that can be opened at the same time. Directory Server autotunes this setting. -
nsslapd-mdb-max-dbs
sets the maximum number of named database instances that can be included within the memory-mapped database file.
Along with the new LMDB settings, you can still use the nsslapd-db-home-directory
database configuration parameter.
RHEL 10 provides openldap
version 2.6.8
The openldap
package has been updated to version 2.6.8. The update includes various enhancements and bug fixes, including:
- Handling of TLS connections has been improved.
-
Kerberos
SASL
works withSTARTTLS
even when the Active Directory certificate is an Elliptic Curve Cryptography (ECC) certificate andSASL_CBINDING
is set totls-endpoint
.
Directory Server now provides buffering of the error, audit, and audit fail logs
Before this update, only the access and security logs had log buffering. With this update, Directory Server provides buffering of the error, audit, and audit fail logs. Use the following settings to configure log buffering:
-
nsslapd-errorlog-logbuffering
for the error log. Disabled by default. -
nsslapd-auditlog-logbuffering
for the audit and audit fail log. Enabled by default.
For details, see nsslapd-errorlog-logbuffering and nsslapd-auditlog-logbuffering in the RHDS Configuration and schema reference documentation.
Now you can configure hashing iterations values in PBKDF2-* Password Storage Schemes plug-in entries
Before this update, the number of hashing iterations was hardcoded (10000
) for all PBKDF2-* entries of the Password Storage Schemes plug-in. With this update, the hashing iterations value is now configured by using the new nsslapd-pwdpbkdf2numiterations
attribute that is 100000
by default.
You can configure nsslapd-pwdpbkdf2numiterations
by using the command line or the web console.
For example, to set the value to 150000
and see the current value in different password storage schemes, run:
dsconf <instance_name> plugin pwstorage-scheme pbkdf2-sha512 set-num-iterations 150000 dsconf <instance_name> plugin pwstorage-scheme pbkdf2-sha512 get-num-iterations
# dsconf <instance_name> plugin pwstorage-scheme pbkdf2-sha512 set-num-iterations 150000
# dsconf <instance_name> plugin pwstorage-scheme pbkdf2-sha512 get-num-iterations
In the web console, go to menu:[Database → Password Policies → Global Policy] to configure hashing iterations.
Consider the following before changing the default value:
- Old passwords have an old hashing iterations setting until the passwords are updated.
- An increased number of iterations can impact BIND operation performance.
dsctl healthcheck
now warns about creating a substring index on the membership attribute
An entry that contains a membership attribute is usually a group with many members. When changing the value set, substring index is very expensive even for a minor change like deleting a single member. Now, when you add the substring index type, dsctl healthcheck
warns about possible high cost of substring index on membership attributes and displays the following error message:
DSMOLE0002
. If the substring index is configured for a membership attribute, the removal of a member from the large group can be slow.
The service type of gssproxy
systemd
service has been changed
The gssproxy
systemd
service type has been changed from "forking" to "notify". This update removes the dependency on PIDFile, which is necessary for improved compatibility with bootc
. With this update, the gssproxy
service uses the "notify" type, providing more reliable service state monitoring.
ACME is now fully supported in IdM
The Automated Certificate Management Environment (ACME) service is now fully supported in Identity Management (IdM). ACME is a protocol for automated identifier validation and certificate issuance. Its goal is to improve security by reducing certificate lifetimes and avoiding manual processes from certificate lifecycle management.
In RHEL, the ACME service uses the Red Hat Certificate System (RHCS) PKI ACME responder. The RHCS ACME subsystem is automatically deployed on every certificate authority (CA) server in the IdM deployment, but it does not service requests until the administrator enables it. RHCS uses the acmeIPAServerCert
profile when issuing ACME certificates. The validity period of issued certificates is 90 days. Enabling or disabling the ACME service affects the entire IdM deployment.
Jira:RHELDOCS-19405[1]
HSM is now fully supported in IdM
Hardware Security Modules (HSM) are now fully supported in Identity Management (IdM). You can store your key pairs and certificates for your IdM Cerificate Authority (CA) and Key Recovery Authority (KRA) on an HSM. This adds physical security to the private key material.
IdM relies on the networking features of the HSM to share the keys between machines to create replicas. The HSM provides additional security without visibly affecting most IdM operations. When using low-level tooling the certificates and keys are handled differently but this is seamless for most users.
Migration of an existing CA or KRA to an HSM-based setup is not supported. You need to reinstall the CA or KRA with keys on the HSM.
You need the following:
- A supported HSM.
- The HSM Public-Key Cryptography Standard (PKCS) #11 library.
- An available slot, token, and the token password.
To install a CA or KRA with keys stored on an HSM, you must specify the token name and the path to the PKCS #11 library. For example:
ipa-server-install -r EXAMPLE.TEST -U --setup-dns --allow-zone-overlap --no-forwarders -N --auto-reverse --random-serial-numbers -–token-name=HSM-TOKEN --token-library-path=/opt/nfast/toolkits/pkcs11/libcknfast.so --setup-kra
ipa-server-install -r EXAMPLE.TEST -U --setup-dns --allow-zone-overlap --no-forwarders -N --auto-reverse --random-serial-numbers -–token-name=HSM-TOKEN --token-library-path=/opt/nfast/toolkits/pkcs11/libcknfast.so --setup-kra
Jira:RHELDOCS-17465[1]
6.16. SSSD
Support for group merging added in authselect
If you are using the authselect
utility, you no longer need to manually edit the nssswitch.conf
file to enable group merging. With this update, It is now integrated into authselect
profiles, eliminating the need for manual changes.
Jira:RHELDOCS-19936[1]
authselect
is now required by PAM and cannot be uninstalled
With this enhancement, the authselect-libs
package now owns /etc/nsswitch.conf
and selected PAM configuration, including system-auth
, password-auth
, smartcard-auth
, fingerprint-auth
, and postlogin
in /etc/pam.d/
. Ownership of these files has been transferred to authselect-libs
package, with /etc/nsswitch.conf`previously owned by the `glibc
package and the PAM configuration files previously owned by the pam
package. Since authselect
is required by the pam
package, it cannot be uninstalled.
For system upgrades from previous RHEL versions:
-
If an
authselect
configuration already exists,authselect apply-changes
automatically updates the configuration to the latest version. If there was no previousauthselect
configuration on your system, no changes are made. -
On systems managed by
authselect
, any non-authselect configurations are now forcefully overwritten without a prompt during the nextauthselect
call. The--force
option is no longer required.
If you require a special configuration, create a custom authselect
profile. Note that you must manually update custom profiles to keep them up to date with your system.
You can opt-out from using authselect
:
authselect opt-out
# authselect opt-out
Jira:RHELDOCS-19197[1]
Local
profile is the new default authselect
profile
Due to the removal of the SSSD files provider, a new authselect
local
profile has been introduced to handle local user management without relying on SSSD. The local
profile replaces the previous minimal
profile and becomes the default authselect
profile for new installations instead of the sssd
profile.
During upgrades, the authselect
utility automatically migrates existing configurations from minimal
to local
profile.
Additionally, the sssd
authselect
profile has been updated to remove the with-files-domain
and with-files-access-provider
options and it no longer handles local user accounts directly via these options. If you relied on these options, you must update your SSSD configuration to use proxy provider
instead of files provider
.
The sssd
profile now supports the --with-tlog
option, which enables session recording for users managed by SSSD.
Jira:RHELDOCS-19263[1]
Support for dynamic DoT updates in SSSD
SSSD now supports performing all dynamic DNS (dyndns) queries using DNS-over-TLS (DoT). You can securely update DNS records when IP addresses change, such as Identity Management (IdM) and Active Directory servers. To enable this functionality, you must install the nsupdate
tool from the bind9.18-utils
package.
You can use the following new options in the sssd.conf
file to enable DoT and configure custom certificates for secure DNS updates:
- dyndns_dns_over_tls
- dyndns_tls_ca_cert
- dyndns_tls_cert
- dyndns_tls_key
For more details about these options, see the sssd-ad(5)
and sssd-ad(5)
man pages on your system.
Jira:RHELDOCS-20014[1]
New SSSD option: exop_force
You can use the exop_force
option to force a password change even if no grace logins are left. Previously, SSSD did not attempt password changes if the LDAP server indicated that there were no grace logins remaining. Now, if you set ldap_pwmodify_mode = exop_force
in the [domain/…]
section of the sssd.conf
file, SSSD tries to change the password even if no grace logins are left.
Jira:RHELDOCS-19863[1]
Running SSSD with reduced privileges
To support general system hardening (running software with least privileges possible), the System Security Services Daemon (SSSD) service is now configured to run under sssd
or root
using the systemd
service configuration files (service user). This service user now defaults to sssd
and irrespective of what service user is configured, root
or sssd
, all root capabilities are dropped with the exception of a few privileged helper processes.
Note that you must ensure the correct ownership of configuration files. The sssd.conf
file must be owned by the same user that is used to run the SSSD service. By default, in RHEL 10, this is the sssd
user. If you create your sssd.conf
file either manually or via an Ansible script, ensure the ownership is correct. For example, if you create a sssd.conf
file under the root
user, you must change the ownership to sssd:sssd
using the chown
command.
Jira:RHELDOCS-18882[1]
Support for KnownHostsCommand
has been added to SSSD
With this update, support for KnownHostsCommand
has been added to SSSD. You can use the tool sss_ssh_knownhosts
with the SSH KnownHostsCommand
configuration option to retrieve the host’s public keys from a remote server, such as FreeIPA, LDAP, and others. The sss_ssh_knownhosts
tool replaces the less reliable sss_ssh_knownhostsproxy
tool. sss_ssh_knownhostsproxy
is no longer available and a message is displaying indicating the tool is obsolete.
Jira:RHELDOCS-19162[1]
6.17. Desktop
Window overview added to GNOME classic
In previous versions, the overview of open windows was not available while using the GNOME classic session. With this update, you can use the overview in both the standard GNOME and classic mode sessions. This makes the overview’s features, including system search, available to classic mode users. Users can now also use classic mode extensions with the default GNOME session.
Jira:RHELDOCS-19060[1]
RHEL 10 provides enhanced fonts in GNOME desktop
The appearance of fonts has been improved in RHEL 10, with most languages using variable fonts (VF):
- The GNOME default fonts have changed to Red Hat fonts (previously Abattis Cantarell for Sans and Adobe Source Code Pro for Mono).
- The default core fonts have changed from Deja Vu to the Google Noto VF family for most languages.
- The default installed Chinese, Japanese, and Korean Noto fonts are now VF, though the static fonts are still available.
- The default fonts for Indic (India), Thai, and Khmer have changed to Noto VF which also have the Serif face.
- The default Malayalam fonts have been improved.
-
The
default-fonts
meta-packages have been introduced to pull in the appropriate default fonts for each language, making it easier to install default font coverage for particular languages. These meta-packages are installed by default for GNOME desktop.
Other enhancements include the following:
- Indic input methods for India follow the newer Inscript 2 Government standard.
-
New
bash-color-prompt
package sets up a default colored Bash shell prompt.
GNOME Online Accounts can restrict which features providers can use
You can use the new goa.conf
file in the system configuration directory, usually named /etc/goa.conf
, to limit what features each provider can use.
In the goa.conf
file, the group name defines the provider type, and the keys define boolean switches to disable the respective features. If you do not set any key or section for a feature, the feature is enabled.
For example, to disable the mail feature for Google accounts, use the following setting:
[google] mail=false
[google]
mail=false
You can use the all
special section name to cover every provider. The value in the specific provider has precedence, if it exists and contains a valid boolean value. Note that some combinations of disabled features can lead to incomplete or invalid accounts being read by the GOA users, such as the Evolution application. Always test the changes first. Restart the GNOME Online Accounts for the changed configuration to take effect.
RHEL Flatpak Firefox, Thunderbird, Runtime, and SDK are supported
In RHEL 10.0, the following applications are fully supported in RHEL Flatpak:
- Firefox
- Flatpak Runtime
- SDK
- Thunderbird
In addition, RHEL Flatpak is also supported in Satellite 6.17, see Satellite 6.17 Release notes for more information.
To learn more about RHEL Flatpak, see the Introducing the Red Hat Flatpak Runtime for desktop containers blog post.
You can install RHEL Flatpak application on RHEL 10 systems by performing the following steps:
Log into the Red Hat Container Catalog. Provide the credentials to your Red Hat Customer Portal account or your registry service account tokens:
podman login registry.redhat.io Username: _<your_user_name>_ Password: _<your_password>_
podman login registry.redhat.io Username: _<your_user_name>_ Password: _<your_password>_
Copy to Clipboard Copied! By default, Podman saves your credentials until you log out.
Optional: Save your credentials permanently. Use one of the following options:
Save the credentials for the current user:
cp $XDG_RUNTIME_DIR/containers/auth.json \ $HOME/.config/flatpak/oci-auth.json
# cp $XDG_RUNTIME_DIR/containers/auth.json \ $HOME/.config/flatpak/oci-auth.json
Copy to Clipboard Copied! Save the credentials system-wide:
cp $XDG_RUNTIME_DIR/containers/auth.json \ /etc/flatpak/oci-auth.json
# cp $XDG_RUNTIME_DIR/containers/auth.json \ /etc/flatpak/oci-auth.json
Copy to Clipboard Copied! For best practices, log into the Red Hat Container Catalog by using registry account tokens when installing credentials system-wide.
Install the Firefox RHEL 10 Flatpak:
flatpak install rhel org.mozilla.firefox
$ flatpak install rhel org.mozilla.firefox
Copy to Clipboard Copied! NoteFor RHEL 10.0, the ID of the Firefox RHEL Flatpak has been changed from
org.mozilla.Firefox
toorg.mozilla.firefox
Run Firefox
From the command line:
flatpak run org.mozilla.firefox
$ flatpak run org.mozilla.firefox
Copy to Clipboard Copied! - Launch Firefox from GNOME Activities Overview.
Jira:RHEL-53563[1]
RHEL 10 provides Papers
Papers is a document viewer application for the GNOME desktop. Papers supports thumbnails, outlines, PDF, Tiff, and the comic book formats. Other features include:
- Displaying signatures.
-
Modernized user interface (UI) with the GTK4 toolkit and the
libadwaita
library to handle desktop and mobile use cases. - Signing of PDF files.
You cannot use Papers to open PostScript files. To open PostScript files, convert them to PDF and open the PDF. Papers is not able to open XPS files.
Jira:RHELDOCS-19661[1]
6.18. The web console
New package: cockpit-files
The cockpit-files
package provides the File manager page in the RHEL web console. With the File manager, you can perform the following actions:
- Browse files and directories on file systems you can access
- Sort files and directories by various criteria
- Filter displayed files by a sub-string
- Copy, move, delete, and rename files and directories
- Create directories
- Upload files
- Bookmark file paths
- Use keyboard shortcuts for the actions
Jira:RHELDOCS-16362[1]
6.19. Red Hat Enterprise Linux System Roles
Support for new ha_cluster
system role features
The ha_cluster
system role now supports the following features:
- Configuring utilization attributes for node and primitive resources.
-
Configuring node addresses and SBD options by using the
ha_cluster_node_options
variable. If bothha_cluster_node_options
andha_cluster
variables are defined, their values are merged, with values fromha_cluster_node_options
having precedence. - Configuring access control lists (ACLs).
- Configuring Pacemaker alerts to take an external action when a cluster event such as node failure or resource starting or stopping occurs.
-
Easy installation of agents for cloud environments by setting the
ha_cluster_install_cloud_agents
variable totrue
.
Jira:RHEL-34893[1], Jira:RHEL-34894, Jira:RHEL-34898, Jira:RHEL-34885
Support for exporting corosync
configuration of an existing cluster
The ha_cluster
RHEL system role now supports exporting the corosync
configuration of an existing cluster in a format that can be fed back to the role to recreate the same cluster. If you did not use the ha_cluster
RHEL system role to create your cluster, or if you have lost the original playbook for the cluster, you can use this feature to build a new playbook for the cluster.
New sudo
RHEL system role
sudo
is a critical part of RHEL system configuration. With the new sudo
RHEL system role, you can consistently manage sudo configuration at scale across your RHEL systems.
The storage
RHEL system role can now manage Stratis pools
With this enhancement, you can use the storage
RHEL system role to complete the following tasks:
- Create a new encrypted and unencrypted Stratis pool
- Add new volumes to the existing Stratis pool
- Add new disks to the Stratis pool
For details on how to manage Stratis pools and other related information, see the resources in the /usr/share/doc/rhel-system-roles/storage/
directory.
Jira:RHEL-40798[1]
New variables in the podman
RHEL system role: podman_registry_certificates
and podman_validate_certs
The following two variables have been added to the podman
RHEL system role:
-
podman_registry_certificates
(list of dictionary elements): Enables you to manage TLS certificates and keys used to connect to the specified container image registry. -
podman_validate_certs
(boolean, defaults to null): Controls whether pulling images from container image registries will validate TLS certificates or not. The default null value means that it is used whatever the default configured by thecontainers.podman.podman_image
module is. You can override thepodman_validate_certs
variable on a per-specification basis with thevalidate_certs
variable.
As a result, you can use the podman
RHEL system role to configure TLS settings for connecting to container image registries.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/podman/
directory. Alternatively, you can review the containers-certs(5)
manual page.
Jira:RHEL-34884[1]
New variables in the podman
RHEL system role: podman_registry_username
and podman_registry_password
The podman
RHEL system role now enables you to specify the container image registry credentials either globally or on a per-specification basis. For that purpose, you must configure both role variables:
-
podman_registry_username
(string, defaults to unset): Configures the username for authentication with the container image registry. You must also set thepodman_registry_password
variable. You can overridepodman_registry_username
on a per-specification basis with theregistry_username
variable. Each operation involving credentials would then be performed according to the detailed rules and protocols defined in that specification. -
podman_registry_password
(string, defaults to unset): Configures the password for authentication with the container image registry. You must also set thepodman_registry_username
variable. You can overridepodman_registry_password
on a per-specification basis with theregistry_password
variable. Each operation involving credentials would then be performed according to the detailed rules and protocols defined in that specification. For security, encrypt the password using the Ansible Vault feature.
As a result, you can use the podman
RHEL system role to manage containers with images, whose registries require authentication for access.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/podman/
directory.
Jira:RHEL-34890[1]
New variable in the podman
RHEL system role: podman_credential_files
Some operations need to pull container images from registries in an automated or unattended way and cannot use the podman_registry_username
and podman_registry_password
variables.
Therefore, the podman
RHEL system role now accepts the containers-auth.json
file to authenticate against container image registries. For that purpose, you can use the following role variable:
podman_credential_files
(list of dictionary elements)- Each dictionary element in the list defines a file with user credentials for authentication to private container image registries. For security, encrypt these credentials using the Ansible Vault feature. You can specify file name, mode, owner, group of the file, and can specify the contents in different ways. See the role documentation for more details.
As a result, you can input container image registry credentials for automated and unattended operations.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/podman/
directory. Alternatively, you can review the containers-auth.json(5)
and containers-registries.conf(5)
manual pages.
Jira:RHEL-34891[1]
New variables in the journald
RHEL system role: journald_rate_limit_interval_sec
and journald_rate_limit_burst
The following two variables have been added to the journald
RHEL system role:
-
journald_rate_limit_interval_sec
(integer, defaults to 30): Configures a time interval in seconds, within which only thejournald_rate_limit_burst
log messages are handled. Thejournald_rate_limit_interval_sec
variable corresponds to theRateLimitIntervalSec
setting in thejournald.conf
file. -
journald_rate_limit_burst
(integer, defaults to 10 000): Configures the upper limit of log messages, which are handled within the time defined byjournald_rate_limit_interval_sec
. Thejournald_rate_limit_burst
variable corresponds to theRateLimitBurst
setting in thejournald.conf
file.
As a result, you can use these settings to tune the performance of the journald
service to handle applications that log many messages in a short period of time.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/journald/
directory.
Jira:RHEL-34892[1]
The ssh
RHEL system role now recognizes the ObscureKeystrokeTiming
and ChannelTimeout
configuration options
The ssh
RHEL system role has been updated to reflect addition of the following configuration options in the OpenSSH utility suite:
-
ObscureKeystrokeTiming
(yes|no|interval specifier, defaults to 20): Configures whether thessh
utility should obscure the inter-keystroke timings from passive observers of network traffic. -
ChannelTimeout
: Configures whether and how quickly thessh
utility should close inactive channels.
When using the ssh
RHEL system role, you can use the new options like in this example play:
- name: Non-exclusive ssh configuration hosts: managed-node-01.example.com tasks: - name: Configure ssh to obscure keystroke timing and set 5m session timeout ansible.builtin.include_role: name: rhel-system-roles.ssh vars: ssh_ObscureKeystrokeTiming: "interval:80" ssh_ChannelTimeout: "session=5m"
- name: Non-exclusive ssh configuration
hosts: managed-node-01.example.com
tasks:
- name: Configure ssh to obscure keystroke timing and set 5m session timeout
ansible.builtin.include_role:
name: rhel-system-roles.ssh
vars:
ssh_ObscureKeystrokeTiming: "interval:80"
ssh_ChannelTimeout: "session=5m"
The storage
RHEL system role can now resize LVM physical volumes
If the size of a block device has changed and you use this device in an LVM, you can adjust the LVM physical volume as well. With this enhancement, you can use the storage
RHEL system role to resize LVM physical volumes to match the size of the underlying block devices after you resized it. To enable automatic resizing, set grow_to_fill: true
on the pool in your playbook.
Jira:RHEL-40797[1]
The nbde_client
RHEL system role now enables you to skip running certain configurations
With the nbde_client
RHEL system role you can now disable the following mechanisms:
- Initial ramdisk
- NetworkManager flush module
- Dracut flush module
The clevis-luks-askpass
utility unlocks some storage volumes late in the boot process after the NetworkManager service puts the OS on the network. Therefore, no configuration changes to the mentioned mechanisms are necessary.
As a result, you can disable the mentioned configurations from being run to support advanced networking setups, or volume decryption to occur late in the boot process.
Jira:RHEL-45718[1]
New variable in the postfix
RHEL system role: postfix_files
The postfix
RHEL system role now enables you to configure extra files for the Postfix mail transfer agent. For that purpose, you can use the following role variable:
postfix_files
-
Defines a list of files to be placed in the
/etc/postfix/
directory that can be converted into Postfix Lookup Tables if needed. This variable enables you to configure Simple Authentication and Security Layer (SASL) credentials, and similar. For security, encrypt files that contain credentials and other secrets using the Ansible Vault feature.
As a result, you can use the postfix
RHEL system role to create these extra files and integrate them in your Postfix configuration.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/postfix/
directory.
Jira:RHEL-46855[1]
The snapshot
RHEL system role now supports managing snapshots of LVM thin pools
With thin provisioning, you can use the snapshot
RHEL system role to manage snapshots of LVM thin pools. These thin snapshots are space-efficient and only grow as data is written or modified after the snapshot is taken. The role automatically detects if the specified volume is scheduled for a thin pool. The added feature could be useful in environments where you need to take frequent snapshots without consuming a lot of physical storage.
Jira:RHEL-48230[1]
New option in the logging
RHEL system role: reopen_on_truncate
The files
input type of the logging_inputs
variable now supports the following option:
reopen_on_truncate
(boolean, defaults to false)-
Configures the
rsyslog
service to re-open the input log file if it was truncated, such as during log rotation. Thereopen_on_truncate
role option corresponds to thereopenOnTruncate
parameter forrsyslog
.
As a result, you can configure rsyslog
in an automated fashion through the logging
RHEL system role to re-open an input log file if it was truncated.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/logging/
directory.
Jira:RHEL-48609[1]
New variable in the logging
RHEL system role: logging_custom_config_files
You can provide custom logging configuration files by using the following variable for the logging
RHEL system role:
logging_custom_config_files
(list)-
Configures a list of configuration files to copy to the default logging configuration directory. For example, for the
rsyslog
service it is the/etc/rsyslog.d/
directory. This assumes the default logging configuration loads and processes the configuration files in that directory. The defaultrsyslog
configuration has a directive such as$IncludeConfig /etc/rsyslog.d/*.conf
.
As a result, you can use customized configurations not provided by the logging
RHEL system role.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/logging/
directory.
Jira:RHEL-50288[1]
The logging
RHEL system role can set ownership and permissions for rsyslog
files and directories
The files
output type of the logging_outputs
variable now supports the following options:
-
mode
(raw, defaults to null): Configures theFileCreateMode
parameter associated with theomfile
module in thersyslog
service. -
owner
(string, defaults to null): Configures thefileOwner
orfileOwnerNum
parameter associated with theomfile
module inrsyslog
. If the value is an integer, it setsfileOwnerNum
. Otherwise, it setsfileOwner
. -
group
(string, defaults to null): Configures thefileGroup
orfileGroupNum
parameter associated with theomfile
module inrsyslog
. If the value is an integer, it setsfileGroupNum
. Otherwise, it setsfileGroup
. -
dir_mode
(defaults to null): Configures theDirCreateMode
parameter associated with theomfile
module inrsyslog
. -
dir_owner
(defaults to null): Configures thedirOwner
ordirOwnerNum
parameter associated with theomfile
module inrsyslog
. If the value is an integer, it setsdirOwnerNum
. Otherwise, it setsdirOwner
. -
dir_group
(defaults to null): Configures thedirGroup
ordirGroupNum
parameter associated with theomfile
module inrsyslog
. If the value is an integer, it setsdirGroupNum
. Otherwise, it setsdirGroup
.
As a result, you can set ownership and permissions for files and directories created by rsyslog
.
Note that the file or directory properties are the same as the corresponding variables in the Ansible file
module.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/logging/
directory. Alternatively, review the output of the ansible-doc file
command.
Jira:RHEL-50289[1]
Using the storage
RHEL system role creates fingerprints on managed nodes
If not already present, storage
creates a unique identifier (fingerprint) every time you run this role. The fingerprint has the form of the # system_role:storage
string written to the /etc/fstab
file on your managed nodes. As a result, you can track which nodes are managed by storage
.
Jira:RHEL-50291[1]
New src
parameter is added to the network
RHEL system role
The src
parameter to the route
sub-option of the ip
option for the network_connections
variable has been added. This parameter specifies the source IP address for a route. It is useful typically for the multi-WAN connections. There you get setups where a machine has multiple public IP addresses, and you want to ensure that outbound traffic uses a specific IP address tied to a particular network interface. As a result, support for the src
parameter provides better control over traffic routing and ensures a more robust and flexible network configuration capability in the described scenarios
For more details, see the resources in the /usr/share/doc/rhel-system-roles/network/
directory.
Jira:RHEL-53901[1]
Support for configuring GFS2 file systems on RHEL 9 clusters by using RHEL system roles
Red Hat Enterprise Linux 10 supports the configuration and management of the Red Hat Global File System 2 (GFS2) by using the gfs2
RHEL system role on a RHEL 10 control node to manage RHEL 9 systems. The Red Hat Enterprise Linux (RHEL) Resilient Storage Add-On, which includes the GFS2 file system, is itself not supported on RHEL 10 systems. The role creates GFS2 file systems in a Pacemaker cluster managed with the pcs
command-line interface.
Previously, setting up GFS2 file systems in a supported configuration required you to follow a long series of steps to configure the storage and cluster resources. The gfs2
role simplifies the process. Using the role, you can specify only the minimum information needed to configure GFS2 file systems in a RHEL high availability cluster.
The gfs2 role performs the following tasks:
- Installing the packages necessary for configuring a GFS2 file system in a Red Hat high availability cluster
-
Setting up the
dlm
andlvmlockd
cluster resources - Creating the LVM volume groups and logical volumes required by the GFS2 file system
- Creating the GFS2 file system and cluster resources with the necessary resource constraints
Jira:RHEL-34828[1]
New variables in the microsoft.sql.server
system role: mssql_tools_versions
and mssql_tls_self_sign
The new mssql-tools18
package brings functionality that is not backwards-compatible with the previous versions of the mssql-tools
package. Therefore the following variables have been added to the microsoft.sql.server
system role to adapt to the changes:
-
mssql_tools_versions
(list, defaults to version 18): Enables you to install different versions ofmssql-tools
. -
mssql_tls_self_sign
(boolean): Specifies whether the certificates that you use are self-signed or not. Applicable when you also set themssql_tls_enable: true
variable.
When you use mssql-tools18
with self-signed TLS certificates, you have to set mssql_tls_self_sign: true
so that the role sets the -C
flag in the sqlcmd
command-line utility so that your certificates can be trusted.
As a result, you can use these configurations to install mssql_tools
version 17; 18; or both in parallel.
For more details, see the resources in the /usr/share/ansible/roles/microsoft.sql-server/
directory.
New variable in the sudo
RHEL system role: sudo_check_if_configured
The sudo
RHEL system role now has the following variable:
-
sudo_check_if_configured
(boolean): Provides a semantic check of an already configuredsudoers
file in case the Ansible setup is not needed and is skipped.
As a result, you can use this setting to ensure the sudo
role idempotence if Ansible intervention is not required.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/sudo/
directory.
Jira:RHEL-67419[1]
New variable in the systemd
RHEL system role: systemd_units_user
With this update, the systemd
RHEL system role can now also manage user units through the following variable:
-
systemd_units_user
(dictionary): Each key is a name of a user given in one of the lists passed to the role, androot
(even ifroot
is not given). Each value is a dictionary ofsystemd
units for that user, or system units forroot
.
The role does not create new users and it will return an error if you specify a non-existent user.
As a result, you can use this setting to manage user units with the systemd
RHEL system role.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/systemd/
directory.
Jira:RHEL-67420[1]
New RHEL system role: aide
aide
is a new RHEL system role for detecting unauthorized changes to files, directories, and system binaries. With this role, you can accomplish for example the following tasks:
-
Install the
aide
package on the managed node. -
Generate the
/etc/aide.conf
file and template it out to the managed node. - Initialize the (Advanced Intrusion Detection Environment) AIDE database.
- Run AIDE integrity checks on the managed node.
The role does not explain how to create a suitable AIDE configuration.
As a result, you can manage AIDE at scale in an automated fashion to address your security, compliance or auditing needs.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/aide/
directory.
Jira:RHEL-67411[1]
The microsoft.sql.server
system role enables AES 128-bit and AES 256-bit encryption for AD users
Since version 1.1.83, the adutil
utility supports the Kerberos protocol with AES 128-bit and AES 256-bit encryption when creating and modifying an Active Directory (AD) user. With this update, the microsoft.sql.server
system role automates enabling AES 128-bit and AES 256-bit encryption provided by the Kerberos protocol when creating or modifying AD users. As a result, manual post-configuration tasks are not necessary.
sshd
RHEL system role validates commands and configurations
The sshd
role uses the quote
command when using the command
or shell
plugins to ensure you can use these commands safely. The role also validates certain user-supplied role variables passed to these plugins. This improves the security and robustness of using the role because, without validation, user-supplied variables that contain white space could split and not function correctly.
Jira:RHEL-73441[1]
RHEL 10 provides the postfix
RHEL system role with a new variable postfix_default_database_type
The postfix
system role can determine the default database type used by postfix
and export it as a variable postfix_default_database_type
. As a result, you can set configuration parameters based on the default database type.
Using postfix_default_database_type
in a configuration parameter value is not supported on Ansible 2.9.
Jira:RHEL-70554[1]
The podman
RHEL system role can manage the quadlet units of type Pod
The podman
utility of version 5 added support for Pod
quadlet types. Consequently, the podman
RHEL system role now enables you to also manage the quadlet units of type Pod
.
For more details, see the upstream article.
Jira:RHEL-67417[1]
New property added to the network
RHEL system role network_connections
variable: autoconnect_retries
There is no fine-grained control over the number of automatic retries to reconnect a network connection in the network
RHEL system role. This limitation could be problematic for certain use cases where extending the retry process is critical, particularly in environments with unstable networks. The autoconnect_retries
property added to the to the network_connections
role variable configures how many times NetworkManager attempts to reconnect a network connection after an autoconnect failure. As a result, the network
RHEL system role now allows configuring the number of automatic reconnection attempts after an autoconnect failure using the autoconnect_retries
property in the network_connections
variable. This enhancement provides greater control over network stability and performance, especially in environments with unstable networks.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/network/
directory.
Jira:RHEL-67416[1]
New property added to the network
RHEL system role network_connections
variable: wait_ip
This update provides added support for the wait_ip
property of the ip
option in the network_connections
role variable. The property specifies if the system should consider the network connection as activated only when a specific IP stack is configured. You can configure wait_ip
with the following values:
-
any
: The system considers the connection activated once any IP stack is configured. -
ipv4
: The system waits until IPv4 is configured. -
ipv6
: The system waits until IPv6 is configured. -
ipv4+ipv6
: The system waits until both IPv4 and IPv6 are configured.
As a result, the network
RHEL system role now allows you to configure network connections based on specific IP stack configurations. This enables the connection to remain activated even if an IP address is not assigned, depending on the selected wait_ip
setting.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/network/
directory.
Jira:RHEL-67415[1]
Added support for Valkey as an alternative to Redis
This update provides added support for the Valkey in-memory data structure store. It is an alternative to Redis, which is no longer open source and is being removed from Linux distributions. Valkey is typically used as a high-performance caching layer. It stores data in memory, which accelerates applications by caching frequently accessed data. Additionally, you can use Valkey for other performance-critical operations, for example:
- Storing and retrieving user session data.
- Real-time communication between different application parts.
- Providing fast data access for analytics and monitoring.
Jira:RHEL-67413[1]
New variable in the logging
RHEL system role: logging_custom_templates
The following variable has been added to the logging
RHEL system role:
-
logging_custom_templates
: A list of custom template definitions. You can use it with thelogging_outputs
variable when its option istype: files
ortype: forwards
. You can specify this custom template for each output by setting thetemplate
option in a particularlogging_outputs
specification. Alternatively, you can set this custom template to be used by default for all files and forwards outputs by using thelogging_files_template_format
andlogging_forwards_template_format
global options.
As a result, you can format log entries differently than what the built-in defaults provide.
For more details, see the resources in the /usr/share/doc/rhel-system-roles/logging/
directory.
Jira:RHEL-67286[1]
6.20. Virtualization
Virtualization support for IBM z17 processors
With this update, virtualization on RHEL adds support for the IBM z17 CPUs. As a result, virtual machines hosted on an IBM Z system with RHEL can now use new features that the z17 processors provide.
Jira:RHEL-33137[1]
Retrievable secrets are supported for Secure Execution on IBM Z
With this update, you can use generalized host-based secrets for cryptographic devices in Secure Execution virtual machines (VMs) on IBM Z. As a result, it is no longer needed to store secrets in an initramfs
image when configuring Secure Execution, which simplifies creating a secure VM image. Note that this feature is currently only supported on IBM z17 processors.
Jira:RHEL-25204[1]
RHEL on HPE can run upto 4096 vCPUs
With this feature, a RHEL virtual machine (VM) instance running with the RHEL hypervisor on Hewlett Packard Enterprise Compute Scale-Up Server now supports up to 4096 virtual CPUs, 32 sockets, and 64 TB of memory to handle in-memory databases and other large compute intensive workloads.
Jira:RHEL-57668[1]
RHEL 10 provides nbdkit
version 1.38
The nbdkit
package has been updated to upstream version 1.38, which provides various bug fixes and enhancements. The most notable changes are the following:
- Block size advertising has been enhanced and a new read-only filter has been added.
- The Python and OCaml bindings support more features of the server API.
- Internal struct integrity checks have been added to make the server more robust.
For a complete list of changes, see the upstream release notes.
KVM on IBM Z now supports more than one boot device
Guest operating systems running on KVM on IBM Z hosts can attempt booting from additional devices when the primary boot device is not bootable. This feature is supported for the following device types:
-
virtio-net
-
virtio-blk
-
virtio-scsi/cdrom
To configure the order of the boot devices for the VM, use the order
parameter on the <boot>
line of their XML configuration. The VM will now attempt up to 8 devices for booting.
In addition, these devices now support the loadparm
parameter for the <boot>
line of their XML configuration. By using loadparm
, it is possible to configure which boot entry the device uses when the guest operating system boots from the device.
Jira:RHEL-68444, Jira:RHEL-24070
Newly supported features for virtual machines on 64-bit ARM hosts
The following features are now supported for virtual machines on RHEL hosts that use the 64-bit ARM architecture, also known as aarch64:
- Migrating VMs between 64-bit ARM hosts. Note, however, that the migration currently only works when both hosts use the same CPU type and memory page size.
- The Trusted Platform Module (TPM) Interface Specification (TIS) hardware interface
- Non-volatile dual in-line memory module (NVDIMM) memory device
- The virtio-iommu device
Jira:RHELDOCS-19832[1]
RHEL supports live migrating a VM with a Mellanox virtual function
With this update, you can perform live migration of a virtual machine (VM) with an attached virtual function (VF) of a Mellanox networking device.
However, this feature is currently only supported with a Mellanox CX-7 networking device with a specific firmware version. The VF on the Mellanox CX-7 networking device uses a new mlx5_vfio_pci
driver, which adds functionality that is necessary for the live migration, and libvirt
binds the new driver to the VF automatically.
For more details and limitations, see: Live migrating a virtual machine with an attached Mellanox virtual function
Jira:RHELDOCS-19210[1]
Support for USO in virtio-net
This update adds the User Datagram Protocol (UDP) Segmentation Offload (USO) feature for the Windows virtio-net
driver. This makes it possible for Windows VMs to offload the segmentation of large UDP packets to the underlying virtio-net
device. As a result, this reduces CPU usage in the VMs and improves overall UDP networking performance, especially in workloads that generate high volumes of UDP traffic.
Jira:RHEL-1300[1]
virt-install
now supports creating VMs with SEV-SNP
You can now use the virt-install
utility to create a virtual machine (VM) that uses the AMD Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) feature. To do so, use the launchSecurity sev-snp,policy=0x30000
option.
Note that SEV-SNP is currently provided as a Technology Preview.
Support for VM live migration with shared virtiofs
directory that provides write access to other parties
With this update, you can live migrate a virtual machine (VM) with a virtiofs
shared directory, even if multiple other parties, such as the host and other VMs, have write access to that directory.
Virtual machines supported in RHEL for Real Time
This update introduces full support for real-time virtualization in RHEL for Real Time. You can configure the host and guest operating systems to achieve low-latency and deterministic behavior for virtual machines (VMs). This makes real-time VMs suitable for applications that require real-time performance, such as industrial automation, telecommunications, and automotive systems.
Jira:RHELDOCS-20116[1]
6.21. RHEL in cloud environments
cloud-init now uses NetworkManager as the default network renderer
With this update, the cloud-init
utility uses NetworkManager
(NM) as the back end for network configuration when initializing a cloud instance. As a result, using NM keyfiles in cloud-init
setup no longer requires reconfiguring /etc/cloud/cloud.cfg
.
Jira:RHEL-29720[1]
RHEL 10 provides Unified Kernel Image
Unified Kernel Image (UKI) for RHEL fully supported. To use RHEL UKI, you must first install the kernel-uki-virt
package. RHEL UKI can enhance SecureBoot protection in virtualized and cloud environments.
Jira:RHELDOCS-19840[1]
Enhanced automatic registration for eligible RHEL images
When purchasing certain eligible cloud marketplace subscriptions for RHEL 9.6 or later and for RHEL 10.0 or later, an improved version of the auto-registration function is available.
With the enhanced auto-registration, any RHEL instances on the eligible marketplaces will be automatically registered to Red Hat and automatically receive content updates from Red Hat Update Infrastructure (RHUI) after you establish a trusted connection between your Red Hat account and your account for the respective cloud platform, even if you did not have the trusted connection when you set launched the instance.
For additional details, see Understanding auto-registration.
Jira:RHELDOCS-19664[1]
WSL images of RHEL 8 - 10 are available on the Customer Portal
RHEL 8, RHEL 9, and RHEL 10 images for the Windows Subsystem for Linux (WSL) can now be downloaded from the Red Hat Customer Portal. These images are available for all RHEL subscriptions, including no-cost developer subscriptions. By using the WSL images, you can create RHEL instances on your Windows system.
Note that the WSL images are provided as self-supported. As such, they are not supported by Red Hat, and are intended for application development purposes only.
In addition, the following issues are currently present in the RHEL guest operating system if you use a WSL image with a Windows WSL host:
- WSL instances of RHEL might work incorrectly in a graphical interface. Using a text user interface is recommended instead.
To use podman, you must add the following lines to the
/etc/containers/containers.conf
file, in addition to the standard configuration steps:[network] firewall_driver="iptables"
[network] firewall_driver="iptables"
Copy to Clipboard Copied! To use cloud-init, you must create the
/etc/cloud/cloud.cfg.d/99_wsl.cfg
file and add the following content to it, in addition to the standard configuration steps:datasource_list: [WSL] network: {config: disabled}
datasource_list: [WSL] network: {config: disabled}
Copy to Clipboard Copied! - It is not possible to set SELinux to enforcing mode.
- FIPS mode is not available in WSL instances of RHEL.
6.22. Supportability
The --api-url
option is now available
With the --api-url
option you can call another API as required. For example, the API for an OCP cluster. Example: sos collect --cluster-type=ocp --cluster-option ocp.api-url=_<API_URL> --alloptions
.
The new --skip-cleaning-files
option is now available
The --skip-cleaning-files
option for the sos report
command allows you to skip cleaning selected files. The option supports globs and wildcards. Example: sos report -o host --batch --clean --skip-cleaning-files 'hostname'
.
Jira:RHEL-30893[1]
The plugin option names now use only hyphens instead of underscores
To ensure consistency across sos
global options, the plugin option names now use only hyphens instead of underscores For example, the networking plugin namespace_pattern
option is now namespace-pattern
and must be specified by using the --plugin-option networking.namespace-pattern=<pattern>
syntax.
Jira:RHELDOCS-18655[1]
6.23. Containers
Image mode for RHEL now supports FIPS mode
With this enhancement, you can enable the FIPS mode when building a bootc image to configure the system to use only FIPS-approved modules. You can use bootc-image-builder
, which requires enabling the FIPS crypto policy in the Containerfile configuration, or use the RHEL Anaconda installation, that additionally to enabling FIPS mode in the Containerfile, also requires adding the fips=1
kernel argument when booting the system installation. See Installing the system with FIPS mode enabled for more details.
The following is a Containerfile with instructions to enable the fips=1
kernel argument.
FROM registry.redhat.io/rhel9/rhel-bootc:latest# # Enable fips=1 kernel argument: https://bootc-dev.github.io/bootc//building/kernel-arguments.html COPY 01-fips.toml /usr/lib/bootc/kargs.d/ # Install and enable the FIPS crypto policy RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS
FROM registry.redhat.io/rhel9/rhel-bootc:latest#
# Enable fips=1 kernel argument:
https://bootc-dev.github.io/bootc//building/kernel-arguments.html
COPY 01-fips.toml /usr/lib/bootc/kargs.d/
# Install and enable the FIPS crypto policy
RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS
The content of 01-fips.toml
is:
kargs = ["fips=1"]
kargs = ["fips=1"]
Jira:RHELDOCS-18585[1]
Support to creating and deploying VMDK with bootc-image-builder
With this enhancement, now you can create a Virtual Machine Disk (VMDK) from a bootc image, by using the bootc-image-builder
tool, and deploy VMDK images to VMware vSphere.
Jira:RHELDOCS-18398[1]
Podman and Buildah support adding OCI artifacts to image indexes
With this update, you can create artifact manifests and add them to image indexes.
The buildah manifest add
command now supports the following options:
-
the
--artifact
option to create artifact manifests -
the
--artifact-type
,--artifact-config-type
,--artifact-layer-type
,--artifact-exclude-titles
, and--subject
options to finetune the contents of the artifact manifests it creates.
The buildah manifest annotate
command now supports the following options:
-
the
--index
option to set annotations on the index itself instead of a one of the entries in the image index -
the
--subject
option for setting the subject field of an image index.
The buildah manifest create
command now supports the --annotation
option to add annotations to the new image index.
Option is available to disable Podman healthcheck event
This enhancement adds a new healthcheck_events
option in the containers.conf
configuration file under the [engine]
section to disable the generation of health_status
events. Set healthcheck_events=false
to disable logging healthchek events.
Runtime resource changes in Podman are persistent
The updates of container configuration by using the podman update
command are persistent. Note that this enhancement is for both SQLite and BoltDB database backends.
Building multi-architecture images is fully supported
The podman farm build
command that creates multi-architecture container images is now fully supported.
A farm is a group of machines that have a unix Podman socket running in them. The nodes in the farm can have different machines of various architectures. The podman farm build
command is faster than the podman build --arch --platform
command.
You can use podman farm build
to perform the following actions:
- Build an image on all nodes in a farm.
- Bundle an image on all nodes in a farm up into a manifest list.
-
Execute the
podman build
command on all the farm nodes. -
Push the images to the registry specified by using the
--tag
option. - Locally create a manifest list.
- Push the manifest list to the registry.
The manifest list contains one image per native architecture type present in the farm.
Quadlets for pods in Podman are available
Beginning with Podman v5.0, you can use Quadlet to automatically generate a systemd
service file from a pod description.
The Podman v2.0 RESTful API has been updated
The new fields has been added to the libpod/images/json
endpoint:
-
The
isManifest
boolean field to determine if the target is a manifest or not. Thelibpod
endpoint returns both images and manifest lists. -
The
os
andarch
fields for image listing.
Kubernetes YAML now supports a data volume container as an init container
A list of images to automatically mount as volumes can now be specified in Kubernetes YAML by using the "io.podman.annotations.kube.image.automount/$ctrname"
annotation. Image-based mounts using podman run --mount type=image,source=<image>,dst=<path>,subpath=<path>
now support a new option, subpath
, to mount only part of the image into the container.
The containers.conf
file is now read-only
The system connections and farm information stored in the containers.conf
file is now read-only. The system connections and farm information will now be stored in the podman.connections.json
file, managed only by Podman. Podman continues to support the old configuration options such as [engine.service_destinations]
and the [farms]
section. You can still add connections or farms manually if needed however, it is not possible to delete a connection from the containers.conf
file with the podman system connection rm
command.
You can still manually edit the containers.conf
file if needed. System connections that were added by Podman v4.0 remain unchanged after the upgrade to Podman v5.0.
Default settings changes for Podman v5.0
In RHEL 10.0, the following default settings changes for Podman v5.0:
- cgroups v2 is used by default instead of cgroups v1
-
pasta
is the default network used by rootless containers instead ofslirp4netns
A new rhel10/rteval
container image
The real-time registry.redhat.io/rhel10/rteval
container image is now available in the Red Hat Container Registry to run latency analysis on either a standalone RHEL installation. With rhel10/rteval
container image, you can perform latency testing within a containerized setup to determine if such a solution is viable for your real-time workloads or to compare results against a bare-metal run of rteval
. To use this feature, subscribe to RHEL with real-time support. No tuning guidelines are provided.
Jira:RHELDOCS-18522[1]
The --compat-volumes
option is available for Podman and Buildah
You can use the new --compat-volumes
option with the buildah build
, podman build
, and podman farm build
commands. This option triggers special handling for the contents of directories marked using the VOLUME
instruction such that their contents can subsequently only be modified by ADD
and COPY
instructions. Any changes made in those locations by RUN
Instructions will be discarded. Previously, this behavior was the default, but it is now disabled by default.
macvlan
and ipvlan
network interface names are configurable in containers.conf
To specify macvlan
and ipvlan
networks, you can adjust the name of the network interface created inside containers by using the new interface_name
field in the containers.conf
configuration file.
Jira:RHELDOCS-18769[1]
Support to building GCP images by using bootc-image-builder
By using the bootc-image-builder
tool you can now generate .gce
disk images and provision the instances on the Google Compute Engine (GCE) platform.
Jira:RHELDOCS-18472[1]
Podman supports pushing and pulling images compressed with zstd:chunked
You can push images compressed with the zstd:chunked
format to reduce the image size and use partial pulls.
The Container Tools packages have been updated
The updated Container Tools RPM meta-package, which contains the Podman, Buildah, Skopeo, crun
, and runc
tools, is now available. The Buildah has been updated to version 1.39.0, Skopeo has been updated toversion 1.18.0. Podman v5.4 contains the following notable bug fixes and enhancements over the previous version:
-
The
podman update
command now supports a wide variety of options related to healthchecks: the--health-cmd
to define a new healthcheck and--no-healthcheck
to disable an existing healthcheck. These options make it easier to add, modify, or disable healthchecks on running containers. For more information, see thepodman-update(5)
man page. -
The
--mount type=volume
option for thepodman run
,podman create
, andpodman volume create
commands now supports a new option,subpath=
, to make only a subset of the volume visible in the container. -
The
--userns=keep-id
option for thepodman run
,podman create
, andpodman pod create
commands now supports a new option,--userns=keep-id:size=
, to configure the size of the user namespace. -
The
podman kube play
command now supports Container Device Interface (CDI) devices. -
The
podman run
,podman create
, andpodman pod create
commands now support a new option,--hosts-file
, to define the base file used for/etc/hosts
in the container. -
The
podman run
,podman create
, andpodman pod create
commands now support a new option,--no-hostname
, which disables the creation of/etc/hostname
in the container. -
The
podman network create
command now supports a new option for bridge networks,--opt mode=unmanaged
, which allows Podman to use an existing network bridge on the system without changes. -
The
--network
option forpodman run
,podman create
, andpodman pod create
now accepts a new option for bridge networks,host_interface_name
, which specifies a name for the network interface created outside the container. -
The
podman manifest rm
command now supports a new option,--ignore
, to proceed successfully when removing manifests that do not exist. -
The
podman system prune
command now supports a new option,--build
, to remove build containers leftover from prematurely terminated builds. - Podman now passes container hostnames to Netavark, which uses them for any DHCP requests for the container.
-
Packagers can now set the
BUILD_ORIGIN
environment variable when building podman from the Makefile. This provides information on who built the Podman binary, and this information is displayed in thepodman version
andpodman info
commands. Including this information can assist with bug reports by helping maintainers to identify the source and method of the build and installation. -
The
podman kube generate
andpodman kube play
commands can now create and run Kubernetes Job YAML. -
The
podman kube generate
command now includes information on the user namespaces for pods and containers in the generated YAML. Thepodman kube play
command uses this information to duplicate the user namespace configuration when creating new pods based on the YAML. -
The
podman kube play
command now supports Kubernetes volumes of type image. -
The service name of
systemd
units generated by Quadlet can now be set with theServiceName
key in all supported Quadlet files. -
Quadlets can now disable their implicit dependency on
network-online.target
by using a new key,DefaultDependencies
, supported by all Quadlet files. -
Quadlet
.container
and.pod
files now support a new key,AddHost
, to add hosts to the container or pod. -
The
PublishPort
key in Quadlet.container
and.pod
files can now accept variables in its value. -
Quadlet
.container
files now support two new keys,CgroupsMode
andStartWithPod
, to configure control groups for the container and whether the container will be started with the pod that it is part of. -
Quadlet
.container
files can now use the network of another container by specifying the.container
file of the container to share within the Network key. -
Quadlet
.container
files can now mount images managed by.image
files into the container by using theMount=type=image
key with an.image
target. -
Quadlet
.pod
files now support six new keys,DNS
,DNSOption
,DNSSearch
,IP
,IP6
, andUserNS
, to configureDNS
, static IPs, and user namespace settings for the pod. -
Quadlet
.image
files can now give an image multiple times by specifying theImageTag
key multiple times. -
Quadlets can now be placed in the
/run/containers/systemd
directory as well as existing directories, such as$HOME/containers/systemd
and/etc/containers/systemd/users
. - Quadlet now properly handles subdirectories of a unit directory that is a symlink.
-
The
podman manifest inspect
command now includes the manifest’s annotations in its output. -
The
--add-host
option forpodman create
,podman run
, andpodman pod create
now supports specifying multiple hostnames, semicolon-separated (for examplepodman run --add-host test1;test2:192.168.1.1
). -
The
podman run
andpodman create
commands now support three new options for configuring healthcheck logging:--health-log-destination
(specifies where logs are stored),--health-max-log-count
(specifies how many healthchecks worth of logs are stored), and--health-max-log-size
(specifies the maximum size of the healthcheck log).
For more information about notable changes, see upstream release notes.
Container tools use sigstore signatures for container image verification
With this update, sigstore signatures are used for container image verification instead of GPG signatures, also known as simple signing.
Podman healthcheck log output can be customized
Before this update, when a container was configured with a healthcheck, the output was only recorded in the container state file accessible by using the podman inspect
command. It complicated the debugging process. With this enhancement, you can use the podman update
command with the --health-log-destination
, --health-max-log-count
, and --health-max-log-size
options to configure healthcheck log output.
For more information, see the podman-update
man page.
Jira:RHEL-24623[1]
Deploying a container image by using a single command is now available
You can deploy a container image into a RHEL cloud instance by using a signal command. The system-reinstall-bootc
command installs performs the following actions:
- Pull the supplied image to set up SSH keys or access the system.
-
Run the
bootc install to-existing-root
command with all the bind mounts and SSH keys configured.
Jira:RHELDOCS-19516[1]
Creating custom bootc
images from scratch is now supported
You can create bootc
images from scratch and fully control the contents of the image and tailor the system environment to meet specific requirements. With the bootc-base-imgectl
command, you can create custom bootc
images based on an existing bootc
base image. Bootc Image from Scratch are derived from container images and do not automatically receive updates from the default base image. To include such updates, you must incorporate them manually as part of your container pipeline. Additionally, you can use the rechunk
subcommand in bootc-base-imgectl
on any bootc container image to optimize or restructure the image as needed.
Jira:RHELDOCS-19825[1]
A new image build progressing bar available for bootc-image-builder
Previously, you could not check if an image build was progressing by looking into the logs. With this enhancement, you can check the progress of the image build that you created by using bootc-image-builder
. You can revert to the previous behavior by using the --progress=verbose
argument when building images.
Jira:RHELDOCS-20170[1]
The podman pod inspect
command now provides a JSON array regardless of the number of pods
Previously, the podman pod inspect
command omitted the JSON array when inspecting a single pod. With this update, the podman pod inspect
command now produces a JSON array in the output regardless of the number of pods inspected.
Jira:RHELDOCS-18770[1]
6.24. Lightspeed
The command line assistant powered by RHEL Lightspeed is now available in RHEL
The command line assistant powered by RHEL Lightspeed is available within the RHEL command line as an optional AI tool. The command line assistant includes knowledge from several Red Hat resources. It provides you with interactive workflows to solve issues, implement new RHEL features, find information, and more. As a result, you can experience more accessible and proactive guidance, and thus, enable your further adoption of RHEL.
Jira:RHELDOCS-20020[1]
The command-line assistant powered by RHEL Lightspeed is generally available in RHEL
The command-line assistant powered by RHEL Lightspeed is available within the RHEL command line. The generative AI that powers the assistant is trained on information from the RHEL product documentation and Red Hat Knowledgebase, and can help you to understand, configure, and troubleshoot your RHEL systems in a more accessible way, whether you are new to RHEL or already an experienced user.
Jira:RHELDOCS-20019[1]
The command-line assistant supports using the systemd-creds
as a password store manager
The command-line assistant powered by RHEL Lightspeed integrates CLAD by using the systemd-creds
, a password store manager shipped with RHEL. By using the assistant, you can securely store your passwords by using databases such as PostgreSQL or MySQL as your history backend. As a result, you can listing, showing, encrypting and decrypting unit credentials in a secure manner.
Jira:RHELDOCS-20023[1]
Chapter 7. Technology Preview features
This part provides a list of all Technology Preview features available in Red Hat Enterprise Linux 10.
For information on Red Hat scope of support for Technology Preview features, see Technology Preview Features Support Scope.
7.1. Security
System-wide post-quantum cryptography is available through crypto-policies-pq-preview
as a Technology Preview
The TEST-PQ
subpolicy contained in the new crypto-policies-pq-preview
package provides system-wide post-quantum cryptography (PQC) as a Technology Preview. You can enable PQC by switching to the TEST-PQ
subpolicy and restarting the system, for example:
update-crypto-policies --set DEFAULT:TEST-PQ reboot
# update-crypto-policies --set DEFAULT:TEST-PQ
# reboot
Note that all PQC algorithms in RHEL 10 are provided as a Technology Preview feature. The package and system-wide cryptographic policy name are subject to change when post-quantum cryptography exits the Technology Preview state. See the Post-quantum cryptography in Red Hat Enterprise Linux 10 article (Red Hat Blog) for more information.
RHEL 10 packages liboqs
, oqsprovider
, nss
, openssh
, and gnutls
provide PQC as a Technology Preview
The RHEL 10.0 packages liboqs
, oqsprovider
, nss
, openssh
, and gnutls
provide post-quantum cryptography (PQC) as a Technology Preview. To enable the PQC algorithms, install the crypto-policies-pq-preview
package and apply the TEST-PQ
cryptographic subpolicy.
For details, see the Interoperability of RHEL 10 post-quantum cryptography article (Red Hat Knowledgebase).
Jira:RHEL-65426, Jira:RHEL-65422, Jira:RHEL-58245, Jira:RHEL-58246
Encrypted DNS in RHEL is available as a Technology Preview
You can enable encrypted DNS to secure DNS communication that uses DNS-over-TLS (DoT). Encrypted DNS (eDNS) encrypts all DNS traffic end-to-end, with no fallback to insecure protocols, and aligns with zero trust architecture (ZTA) principles.
To perform a new installation with eDNS, specify the DoT-enabled DNS server by using the kernel command line. This ensures encrypted DNS is active during the installation process, boot time, and on the installed system. If you require a custom CA certificate bundle, you can install it only by using the %certificate
section in the Kickstart file. Currently, the custom CA bundle can be installed only through Kickstart installation.
On an existing system, configure NetworkManager to use a new DNS plugin, dnsconfd
, which manages the local DNS resolver (unbound) for eDNS. Add kernel arguments to configure eDNS for the early boot process, and optionally install a custom CA bundle.
Additionally, Identity Management (IdM) deployments can also use encrypted DNS, with the integrated DNS server supporting DoT.
See Securing system DNS traffic with encrypted DNS for more details.
Jira:RHELDOCS-20058[1], Jira:RHEL-67912
7.2. Software management
Support for signing packages with Sequoia PGP is available as a Technology Preview
The macros.rpmsign-sequoia
macro file that configures RPM to use Sequoia PGP instead of GnuPG for signing packages is now available as a Technology Preview. To enable its usage, perform the following steps:
Install the following packages:
dnf install rpm-sign sequoia-sq
# dnf install rpm-sign sequoia-sq
Copy to Clipboard Copied! Copy the
macros.rpmsign-sequoia
file to the/etc/rpm/
directory:cp /usr/share/doc/rpm/macros.rpmsign-sequoia /etc/rpm/
$ cp /usr/share/doc/rpm/macros.rpmsign-sequoia /etc/rpm/
Copy to Clipboard Copied!
Jira:RHEL-56363[1]
7.3. Shells and command-line tools
The systemd-resolved
service is available as a Technology Preview
The systemd-resolved
service provides name resolution to local applications. The service implements a caching and validating DNS stub resolver, a Link-Local Multicast Name Resolution (LLMNR), and Multicast DNS resolver and responder.
Note that systemd-resolved
is an unsupported Technology Preview.
7.4. Kernel
The Red Hat Enterprise Linux for Real Time on ARM64 is now available as a Technology Preview
With this Technology Preview, the Red Hat Enterprise Linux for Real Time is now enabled for ARM64. The ARM64 is enabled on ARM (AARCH64), for both 4k and 64k ARM kernels.
Jira:RHELDOCS-19635[1]
7.5. File systems and storage
ublk_drv
driver is available as a Technology Preview
The ublk_drv
kernel module is now enabled as a technology preview. It provides the ublk
framework with which you can create and build high-performance block devices from userspace. Currently, ublk
requires userspace implementations, such as the Userspace Block Driver (ublksrv
) or the Rust-based ublk
(rublk
), to function effectively.
Jira:RHELDOCS-19891[1]
NVMe/TCP using TLS is available as a Technology Preview
Encrypting Non-volatile Memory Express (NVMe) over TCP (NVMe/TCP) network traffic using TLS configured with Pre-Shared Keys (PSK) has been added as a Technology Preview in RHEL 10.0. For instructions, see Configuring an NVMe/TCP host using TLS with Pre-Shared-Keys.
Jira:RHELDOCS-19968[1]
xfs_scrub utility is available as a Technology Preview
You can check all the metadata on a mounted XFS file system by using the xfs_scrub
utility as a Technology Preview. It functions similarly to the xfs_repair -n
command for an unmounted XFS filesystem. For details, see the xfs_scrub(8)
man page on your system. Note that currently only the scrub feature is available in RHEL 10 kernels and online repair is not enabled.
Jira:RHELDOCS-20041[1]
Limited shrinking of XFS file systems is available as Technology Preview
You can reduce the size of XFS file systems by using the xfs_growfs
utility as a Technology Preview. You can remove blocks from the end of the file system by using xfs_growfs
, provided that all of the following conditions are true:
- No metadata or data is allocated within the range to be removed.
- The requested size is within the last allocation group.
Jira:RHELDOCS-20042[1]
Mounting XFS file systems with blocks larger than system page is available as Technology preview
You can now mount XFS file systems created with a block size larger than the system page size as a Technology Preview. For example, a file system with 16-KB blocks can now be mounted on a system with a 4-KB page size, such as x86_64.
Jira:RHELDOCS-20043[1]
io-uring
interface is available as a Technology Preview
The io_uring
, which is an asynchronous I/O interface, is available as a Technology Preview. By default, this feature is disabled in RHEL 10. You can enable this interface by setting the kernel/io_uring_disabled
variable:
- For all users:
echo 0 > /proc/sys/kernel/io_uring_disabled
# echo 0 > /proc/sys/kernel/io_uring_disabled
- For root only:
echo 1 > /proc/sys/kernel/io_uring_disabled
# echo 1 > /proc/sys/kernel/io_uring_disabled
You can also disable io_uring
for all processes:
echo 2 > /proc/sys/kernel/io_uring_disabled
# echo 2 > /proc/sys/kernel/io_uring_disabled
7.6. Compilers and development tools
eu-stacktrace
available as a Technology Preview
The eu-stacktrace
utility, which has been distributed through the elfutils
package since version 0.192, is available as a Technology Preview feature. eu-stacktrace
is a prototype utility that uses the elfutils
toolkit’s unwinding libraries to support a sampling profiler to unwind frame pointer-less stack sample data.
Jira:RHELDOCS-19072[1]
7.7. Identity Management
DNSSEC available as Technology Preview in IdM
Identity Management (IdM) servers with integrated DNS now implement DNS Security Extensions (DNSSEC), a set of extensions to DNS that enhance security of the DNS protocol. DNS zones hosted on IdM servers can be automatically signed using DNSSEC. The cryptographic keys are automatically generated and rotated.
Users who decide to secure their DNS zones with DNSSEC are advised to read and follow these documents:
Note that IdM servers with integrated DNS use DNSSEC to validate DNS answers obtained from other DNS servers. This might affect the availability of DNS zones that are not configured in accordance with recommended naming practices.
Jira:RHELPLAN-121751[1]
DNS over TLS (DoT) in IdM deployments is available as a Technology Preview
Encrypted DNS using DNS over TLS (DoT) is now available as a Technology Preview in Identity Management (IdM) deployments. You can now encrypt all DNS queries and responses between DNS clients and IdM DNS servers.
To start using this functionality, install the ipa-server-encrypted-dns
package on IdM servers and replicas, and the ipa-client-encrypted-dns
package on IdM clients. Administrators can enable DoT during the installation using the --dns-over-tls
option.
IdM configures Unbound as a local caching resolver and BIND to receive DoT requests. This functionality is available through the command-line interface (CLI) and non-interactive installations of IdM.
The following options were added to installation utilities for IdM servers, replicas, clients, and the integrated DNS service:
-
--dot-forwarder
to specify an upstream DoT-enabled DNS server. -
--dns-over-tls-key
and--dns-over-tls-cert
to configure DoT certificates. -
--dns-policy
to set a DNS security policy to either allow fallback to unencrypted DNS or enforce strict DoT usage.
By default, IdM uses the relaxed
DNS policy, which allows fallback to unencrypted DNS. You can enforce encrypted-only communication by using the new --dns-policy
option with the enforced
setting.
You can also enable DoT on an existing IdM deployment by reconfiguring the integrated DNS service using ipa-dns-install
with the new DoT options.
See Securing DNS with DoT in IdM for more details.
Jira:RHEL-67912, Jira:RHELDOCS-20058
IdM-to-IdM migration is available as a Technology Preview
IdM-to-IdM migration is available in Identity Management as a Technology Preview. You can use a new ipa-migrate
command to migrate all IdM-specific data, such as SUDO rules, HBAC, DNA ranges, hosts, services, and more, to another IdM server. This can be useful, for example, when moving IdM from a development or staging environment into a production one or when migrating IdM data between two production servers.
Jira:RHELDOCS-18408[1]
logconv.py
is available as a Technology Preview
The logconv.py
utility is available in Directory Server as a Technology Preview. logconv.py
is a future replacement for the old logconv.pl
utility that you could use to analyze Directory Server access logs, extract usage statistics, and count occurrences of significant events.
The utility syntax:
logconv.py /var/log/dirsrv/slapd-<instance_name>/access
logconv.py /var/log/dirsrv/slapd-<instance_name>/access
For more details about the utility options and usage examples, run the logconv.py -h
command.
7.8. Virtualization
AMD SEV, SEV-ES, and SEV-SNP for KVM virtual machines are available as a Technology Preview
As a Technology Preview, RHEL provides the Secure Encrypted Virtualization (SEV) feature for AMD EPYC host machines that use the KVM hypervisor. If enabled on a virtual machine (VM), SEV encrypts the VM’s memory to protect the VM from access by the host. This increases the VM security.
In addition, the enhanced Encrypted State version of SEV (SEV-ES) is also provided as Technology Preview. SEV-ES encrypts all CPU register contents when a VM stops running. This prevents the host from modifying the VM’s CPU registers or reading any information from them.
RHEL also provides the Secure Nested Paging (SEV-SNP) feature as Technology Preview. SNP enhances SEV and SEV-ES by improving its memory integrity protection, which helps to prevent hypervisor-based attacks, such as data replay or memory re-mapping.
Note that: * SEV and SEV-ES work only on the 2nd generation of AMD EPYC CPUs (codenamed Rome) or later. * SEV-SNP works only on 3rd generation AMD EPYC CPUs (codenamed Milan) or later.
Also note that RHEL includes SEV, SEV-ES, and SEV-SNP encryption, but not the SEV, SEV-ES, and SEV-SNP security attestation and live migration.
Jira:RHELDOCS-16800[1]
Creating nested virtual machines
Nested KVM virtualization is provided as a Technology Preview for KVM virtual machines (VMs) running on Intel, AMD64, and IBM Z hosts with RHEL 10. With this feature, a RHEL 7, RHEL 8, or RHEL 9 VM that runs on a physical RHEL 10 host can act as a hypervisor, and host its own VMs.
Jira:RHELDOCS-20080[1]
New package: trustee-guest-components
As a Technology Preview, this update adds the trustee-guest-components
package. This makes it possible for confidential virtual machines to attest themselves and get confidential resources from a Trustee server.
Jira:RHEL-73770[1]
7.9. Containers
composefs
filesystem is available as a Technology Preview
The key technologies composefs
uses are:
- OverlayFS as the kernel interface
- Enhanced Read-Only File System (EROFS) for a mountable metadata tree
-
The
fs-verity
feature (optional) from the lower filesystem
Key advantages of composefs
:
-
Separation between metadata and data.
composefs
does not store any persistent data. The underlying metadata and data files are stored in a valid lower Linux filesystem such asext4
,xfs
,btrfs
, and so on. -
Mounting multiple
composefs
with a shared storage. - Data files are shared in the page cache to enable multiple container images to share their memory.
-
Support
fs-verity
validation of the content files.
The composefs file system is available as Technology Preview
The composefs read-only file system available as Technology Preview is generally intended only to be used by the bootc/ostree and podman projects at the current time. With composefs, you can use these projects to create and use read-only images, share file data between images, and validate images on runtime. As a result, you have a fully verified file-system tree mounted, with opportunistic fine-grained sharing of identical files.
Jira:RHEL-18157[1]
Partial pulls for zstd:chunked
are available as a Technology Preview
You can pull only the changed parts of the container images compressed with the zstd:chunked
format, reducing network traffic and necessary storage. You can enable partial pulls by adding the enable_partial_images = "true"
setting to the /etc/containers/storage.conf
file. This functionality is available as a Technology Preview.
The podman artifact
command is available as a Technology Preview
The podman artifact
command, which you can use to work with OCI artifacts at the command-line level, is available as a Technology Preview. For further informal, please reference the man page.
The vrf
option for the podman network create
is available as a Technology Preview
The podman network create
command now provides the vrf
value for the --opt
option, as a Technology Preview. The vrf
value assigns a virtual routing and forwarding instance (VRF) to the bridge interface. It accepts the name of the VRF and defaults to none.
This option can only be used with the Netavark network backend.
7.10. Technology Preview features identified in previous releases
This part provides a list of all Technology Previews available in Red Hat Enterprise Linux 10.
For information on Red Hat scope of support for Technology Preview features, see Technology Preview Features Support Scope.
7.10.1. Networking
WireGuard VPN is available as a Technology Preview
WireGuard, which Red Hat provides as an unsupported Technology Preview, is a high-performance VPN solution that runs in the Linux kernel. It uses modern cryptography and is easier to configure than other VPN solutions. Additionally, the small code-basis of WireGuard reduces the surface for attacks and, therefore, improves the security.
For further details, see Setting up a WireGuard VPN.
Jira:RHELDOCS-20056[1]
KTLS available as a Technology Preview
In RHEL, Kernel Transport Layer Security (KTLS) is provided as a Technology Preview. KTLS handles TLS records using the symmetric encryption or decryption algorithms in the kernel for the AES-GCM cipher. KTLS also includes the interface for offloading TLS record encryption to Network Interface Controllers (NICs) that provides this functionality.
Note that specific uses cases of kernel TLS offload might have a higher support status. For details see the release notes in the New features and enhancements chapter.
Jira:RHELDOCS-20440[1]
NetworkManager
enables configuring HSR and PRP interfaces
High-availability Seamless Redundancy (HSR) and Parallel Redundancy Protocol (PRP) are network protocols that provide seamless failover against failure of any single network component. Both protocols are transparent to the application layer, meaning that users do not experience any disruption in communication or any loss of data, because a switch between the main path and the redundant path happens very quickly and without awareness of the user. Now it is possible to enable and configure HSR and PRP interfaces using the NetworkManager
service through the nmcli
utility and the DBus message system.
The PRP and HSR protocols are now available as a Technology Preview
This update adds the hsr
kernel module that provides the following protocols:
- Parallel Redundancy Protocol (PRP)
- High-availability Seamless Redundancy (HSR)
The IEC 62439-3 standard defines these protocols, and you can use this feature to configure redundancy with zero-time recovery in Ethernet networks.
Jira:RHELDOCS-20472[1]
Chapter 8. Removed features
All removed features were deprecated in earlier releases and are no longer supported. For information regarding functionality that is present in RHEL 9 but has been removed in RHEL 10, see Considerations in adopting RHEL 10.
8.1. Installer and image creation
auth
or authconfig
commands are removed
The auth
or authconfig
Kickstart commands which were deprecated in Red Hat Enterprise Linux 8, are removed now. As a replacement, use the authselect
kickstart command.
Jira:RHELDOCS-18839[1]
The inst.xdriver and inst.usefbx options have been removed
The graphical system for the installation image switched from the Xorg server to a Wayland compositor. As a consequence, the inst.xdriver
boot option has been removed. Wayland operates without relying on X drivers, making it incompatible with loading any such drivers. As a result, the inst.xdriver
option is no longer applicable.
Additionally, the inst.usefbx
boot option, previously used to load a generic framebuffer X driver, has also been removed.
Jira:RHELDOCS-18818[1]
The openstack image type has been deprecated from RHEL image builder
From the RHEL 10.0 onward, RHEL image builder will no longer support the Openstack image type. You can use the .qcow2
image type to build Openstack images.
Jira:RHELDOCS-18736[1]
Capturing screenshots from the Anaconda GUI with a global hot key is removed
Previously, users could capture screenshots of the Anaconda GUI by using a global hot key. Consequently, users could extract the screenshots manually from the installation environment for any further usage. This functionality has been removed.
Jira:RHELDOCS-18492[1]
Removed inst.nompath
, dmraid
and nodmraid
boot options
The inst.nompath
, dmraid
and nodmraid
boot options have been removed now and are no longer available for use.
Jira:RHELDOCS-18485[1]
Removed automatic bug reporting system from Anaconda
The installer no longer supports automatically reporting problems to the Red Hat issue tracking system. You can collect the installation logs and report problems manually, as described in the troubleshooting section.
Jira:RHELDOCS-18426[1]
Removed a few options of the timezone
Kickstart command
The following options of the timezone
Kickstart command has been removed in Red Hat Enterprise Linux 10:
-
--isUtc
: Use the option--utc
instead. -
--ntpservers
: Use the option--ntp-server
of the timesource kickstart command instead. -
--nontp
: Use the option--ntp-disable
of thetimesource
kickstart command instead.
Jira:RHELDOCS-18423[1]
Removed the --level
parameter of the logging Kickstart command
The --level
parameter of the logging kickstart command has been removed. It is no longer possible to set the level of logging of the installation process.
Jira:RHELDOCS-18417[1]
The support for %anaconda Kickstart command has been removed
The support for the deprecated %anaconda Kickstart command has been removed. You can use the kernel arguments and command line line options to update the configuration in the Anaconda configuration files.
Jira:RHELDOCS-18416[1]
Removed pwpolicy
Kickstart command
The support for the deprecated pwpolicy
Kickstart command has been removed in Red Hat Enterprise Linux 10.
Jira:RHELDOCS-18415[1]
Removed support for adding additional repositories from GUI
Previously, when configuring the installation source, you could configure the additional repositories for the package installation. Starting in RHEL 10, this support has been removed. However, you can use the Kickstart installation method or inst.addrepo
boot option if you want to specify additional repositories.
Jira:RHELDOCS-18413[1]
Removed support of the LUKS version selection from Anaconda
Previously, you could select the LUKS version from the Manual Installation screen. Starting in RHEL 10, the installer uses the luks2
version by default for all the new devices. No changes are made to the existing devices' LUKS version. You can also use the Kickstart method to select different LUKS versions.
Jira:RHELDOCS-18412[1]
The initial-setup
package now has been removed
The initial-setup package has been removed in Red Hat Enterprise Linux 10. As a replacement, use gnome-initial-setup
for the graphical user interface.
Jira:RHELDOCS-18411[1]
Redesigned the Time & Date spoke in the Installer GUI
Previously, Anaconda users were able to select the timezone using the time zone map. This screen is now redesigned and the timezone map has been replaced with the options where users can set the required timezone.
For more information, refer to the installation documentation.
Jira:RHELDOCS-18410[1]
Anaconda built-in help has been removed
The built-in documentation from spokes and hubs of all Anaconda user interfaces, which was available during Anaconda installation, has been removed. Instead, refer to the official RHEL documentation.
Jira:RHELDOCS-18414[1]
Removed teaming options from the network
kickstart command
The --teamslaves
and --teamconfig
options used for configuring team devices in the network
kickstart command have been removed. To configure similar network settings, use the --bondslaves
and --bondopts
options to set up a Bond device.
Removed NVDIMM reconfiguration support during the installation process
The support for reconfiguring NVDIMM devices during the Kickstart and GUI installation has been removed in RHEL-10. However, the NVDIMM devices in the sector mode can still be usable in the installation program.
The --excludeWeakdeps
and --instLangs
options from %packages
have been removed
In RHEL-10, the --excludeWeakdeps
and --instLangs
options used in the %packages
section have been removed. To maintain similar functionality, use the updated options --exclude-weakdeps
and --inst-langs
instead. These replacements ensure compatibility and provide the same dependency and language control within package management.
8.2. Security
scap-workbench
is removed
The scap-workbench
package is removed in RHEL 10. The scap-workbench
graphical utility was designed to perform configuration and vulnerability scans on a single local or remote system. As an alternative, you can scan local systems for configuration compliance by using the oscap
command and remote systems by using the oscap-ssh
command. For more information, see Configuration compliance scanning.
Jira:RHELDOCS-19009[1]
oscap-anaconda-addon
is removed
The oscap-anaconda-addon
, which provided means to deploy baseline-compliant RHEL systems by using the graphical installation, is removed in RHEL 10. As an alternative, you can build RHEL images that comply with a specific standard by Creating pre-hardened images with RHEL image builder OpenSCAP integration.
Jira:RHELDOCS-19010[1]
OVAL removed from vulnerability scanning applications
The Open Vulnerability Assessment Language (OVAL) data format, which provides declarative security data processed by the OpenSCAP suite, has been removed. Red Hat continues to provide declarative security data in the Common Security Advisory Framework (CSAF) format, which is the successor of OVAL.
Jira:RHELDOCS-19071[1]
DSA and SEED algorithms have been removed from NSS
The Digital Signature Algorithm (DSA), which was created by the National Institute of Standards and Technology (NIST) and is now completely deprecated by NIST, is removed from the Network Security Services (NSS) cryptographic library. You can instead use algorithms such as RSA and ECDSA.
The SEED algorithm, which was created by the Korea Information Security Agency (KISA) and has been previously disabled upstream, is removed from the NSS cryptographic library.
fips-mode-setup
is removed
The fips-mode-setup
command is removed from RHEL. To enable the cryptographic module self-checks mandated by the Federal Information Processing Standard (FIPS) 140, enable FIPS mode during the system installation. See the Switching RHEL to FIPS mode chapter in the Security hardening document for more information.
/etc/system-fips
removed
Support for indicating FIPS mode through the /etc/system-fips
file has been removed from RHEL. To install RHEL in FIPS mode, add the fips=1
parameter to the kernel command line during the system installation. You can check whether RHEL operates in FIPS mode by displaying the /proc/sys/crypto/fips_enabled
file.
Jira:RHELDOCS-19357[1]
HeartBeat removed from TLS
The support for the HeartBeat extension in TLS has been removed to reduce the attack surface.
Jira:RHEL-59212[1]
SRP authentication removed from TLS
Authentication that uses Secure Remote Password protocol (SRP) in TLS has been removed from the gnutls
package and is no longer supported. SRP authentication is considered insecure because it cannot be used with TLS 1.3 and relies on Cipher block chaining (CBC) and SHA-1 as a key exchange.
Jira:RHEL-58640[1]
Keylime no longer supports HTTP for revocation notifications
The Keylime components no longer support the HTTP protocol for revocation notification webhooks. Use HTTPS instead. As a consequence, the Keylime verifier now requires the revocation notification webhook server CA certificate. You can add it to the trusted_server_ca
configuration option or add it to the system trust store.
DEFAULT
cryptographic policy rejects TLS ciphers with RSA key exchange
TLS ciphers that use the RSA key exchange are no longer accepted in the DEFAULT
system-wide cryptographic policy in RHEL 10. These ciphers do not provide perfect forward secrecy and are not considered as secure as ciphers that use other key exchanges, for example, the Elliptic-curve Diffie-Hellman (ECDH) key exchange.
This change also reduces the exposure to side-channel attacks because the RSA key exchange uses PKCS #1 v1.5 encryption padding, which can cause vulnerability to timing side-channel attacks.
If you need the RSA key exchange for interoperability with legacy systems, you can re-enable it by using the LEGACY system-wide cryptographic policy or by applying a custom subpolicy.
Jira:RHEL-50464[1]
ca-certificates
trust store moved
The /etc/pki/tls/certs
trust store is converted to a different format better optimized for OpenSSL. As a consequence, if you use the files in /etc/pki/tls/certs
directly, switch to the /etc/pki/ca-trust/extracted
directory, where the same data is stored. For example, software that accesses the trust bundle at /etc/pki/tls/certs/ca-bundle.crt
should switch to using /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
instead.
The LEGACY
cryptographic policy disallows SHA-1 signatures in TLS
The LEGACY
system-wide cryptographic policy in RHEL 10 no longer allows creating or verifying signatures that use SHA-1 in TLS contexts. Therefore, libraries other than OpenSSL might no longer accept or create any signatures that use SHA-1 regardless of use case. OpenSSL continues to accept signatures that use SHA-1 when not used for TLS if the system is in LEGACY
or this functionality is re-enabled with a custom subpolicy.
pam_ssh_agent_auth
is removed
The pam_ssh_agent_auth
package has been removed from RHEL 10.
OpenSSL no longer permits SHA-1 at SECLEVEL=2
in TLS
OpenSSL does not accept the SHA-1 algorithm at SECLEVEL=2
in TLS in RHEL 10. If your scenario requires using TLS 1.0/1.1, you must explicitly set SECLEVEL=0
and switch to the LEGACY system-wide cryptographic policy. In the LEGACY policy, applications that use SHA-1 in signatures outside of TLS will continue to work.
stunnel
does not support OpenSSL ENGINE API
The stunnel
TLS offloading and load-balancing proxy no longer supports the previously deprecated OpenSSL ENGINE API. The most common use case was accessing hardware security tokens by using PKCS #11 through the openssl-pkcs11
package. As a replacement, you can use the pkcs11-provider
, which uses the new OpenSSL provider API.
OpenSSL Engines removed from OpenSSL
OpenSSL Engines have been deprecated and will soon be removed from upstream. Therefore, the openssl-pkcs11
package has been removed from OpenSSL in RHEL 10. Use providers instead, such as the pkcs11-provider
, which is supported in this version.
Keylime policy management scripts are removed and replaced with keylime-policy
In RHEL 10, Keylime is provided with the keylime-policy
tool, which replaces the following policy management scripts:
-
keylime_convert_runtime_policy
-
keylime_create_policy
-
keylime_sign_runtime_policy
-
create_mb_refstate
-
create_allowlist.sh
The scripts have been removed and are no longer provided in RHEL 10.
8.3. Subscription management
Several subscription-manager
modules have been removed
Because of a simplified customer experience in Red Hat subscription services, which have transitioned to the Red Hat Hybrid Cloud Console and to account level subscription management with Simple Content Access, the following previously deprecated modules have been removed:
-
addons
-
attach
-
auto-attach
-
import
-
remove
-
redeem
-
role
-
service-level
-
usage
-
syspurpose addons
For more information about these changes, see the Transition of Red Hat’s subscription services to the Red Hat Hybrid Cloud Console article.
Jira:RHELDOCS-18989[1]
8.4. Software management
The support for the libreport
library has been removed
The support for the libreport
library has been removed from DNF. If you want to attach DNF logs to your bug reports, you need to do it manually or by using a different mechanism.
The DNF debug
plug-in has been removed
The DNF debug
plug-in, which included the dnf debug-dump
and dnf debug-restore
commands, has been removed from the dnf-plugins-core
package. Depending on your scenario, you can use one of the following commands instead:
-
dnf list --installed
ordnf repoquery --installed
to list packages installed on your system. -
dnf repolist -v
to list repositories enabled on your system. dnf install $(</tmp/list)
to replicate packages installed on a source system to the target system. For example:Save a list of packages installed on a source system into the
/tmp/list
file:dnf repoquery --installed >/tmp/list
$ dnf repoquery --installed >/tmp/list
Copy to Clipboard Copied! -
Copy the
/tmp/list
file to the target system. Replicate packages on the target system:
dnf install $(</tmp/list)"
$ dnf install $(</tmp/list)"
Copy to Clipboard Copied!
Jira:RHEL-23706[1]
The numberless %patch
syntax has been removed
Using the %patch
directive without a number specified as a shorthand for %patch 0
to apply the zero-th
patch has been removed. If you want to use %patch
, a warning message suggests you to use the explicit syntax, for example, %patch 0
or %patch -P 0
to apply the zero-th
patch.
Jira:RHELDOCS-19811[1]
8.5. Shells and command-line tools
The perl(Mail::Sender)
module has been removed
The perl(Mail::Sender)
module is removed from RHEL 10 without any replacement. As a consequence, the checkbandwidth
script from net-snmp-perl
package does not support email alerts when bandwidth high/low levels for a host or interface are reached.
Jira:RHEL-44478[1]
8.6. Infrastructure services
Significant changes in the package set for infrastructure services
The following packages are no longer included in Red Hat Enterprise Linux:
-
sendmail
: Red Hat recommends migrating to the postfix mail daemon, that is supported. -
redis
: Red Hat recommends migrating to thevalkey
package. -
dhcp
: Red Hat recommends migrating to the available alternatives such asdhcpcd
andISC Kea
. -
mod_security
: Themod_security
directive is now available in the EPEL repository. -
spamassassin
: The Spamassassin mail filter is now available in the EPEL repository instead of the standard RHEL repository as it depends on thelibdb
(Berkeley DB) library, which is unavailable due to licensing issues. -
xsane
: The API is not yet ported toGtk3
.
The following packages have been renamed:
-
gpsd
: It was previously included asgpsd-minimal
.
Jira:RHEL-22424[1]
The ISC Kea
DHCP server solution is now available
Kea is a new Dynamic Host Configuration Protocol (DHCP) server solution in RHEL. ISC DHCP
was removed in favor of Kea to ensure future delivery of bug fixes and enhancements. The upstream version of ISC DHCP
no longer develops new features and bug fixes.
Jira:RHEL-14710[1]
8.7. Networking
ATM encapsulation is removed from RHEL 10
Asynchronous Transfer Mode (ATM) encapsulation enables Layer-2 (Point-to-Point Protocol, Ethernet) or Layer-3 (IP) connectivity for the ATM Adaptation Layer 5 (AAL-5). Red Hat has not been providing support for ATM NIC drivers since RHEL 7. The support for ATM implementation is being dropped in RHEL 9. These protocols are currently used only in chipsets that support the ADSL technology and are being phased out by manufacturers. Therefore, ATM encapsulation was deprecated in Red Hat Enterprise Linux 9, and it is removed from Red Hat Enterprise Linux 10.
For more information, see PPP Over AAL5, Multiprotocol Encapsulation over ATM Adaptation Layer 5, and Classical IP and ARP over ATM.
Jira:RHELDOCS-20102[1]
The dhcp-client
package has been removed
The dhcp-client
package has been removed from RHEL 10, because the ISC DHCP client is no longer maintained upstream. As a consequence, the dhclient
utility is no longer available and you cannot use it as DHCP client in NetworkManager. As an alternative, use the NetworkManager-internal DHCP client, which was also the default in previous RHEL versions.
The mlx4
driver is removed from RHEL 10.0
With the RHEL 10.0 release, the mlx4
driver for the Mellanox ConnectX-3 network interface controller (NIC) is removed. You must use another NIC that is compatible with newer drivers.
Jira:RHEL-40070[1]
8.8. Kernel
The kexec_load
system call is removed
The kexec_load
system call, which was deprecated in RHEL 9, is removed. In RHEL 10, the kexec_file_load
system call replaces kexec_load
and is the default system call on all architectures. Also, kexec_file_load
is required for a secure boot.
For more information, see Is kexec_load supported in RHEL9?
Jira:RHEL-29272[1]
The crash --log dumpfile
option is deprecated
The crash --log dumpfile
option no longer works for kernel version 5.10 and above. As a consequence, the crash --log
command fails with error message 'crash:VMCOREINFO: no log buffer data'.
You can use makedumpfile --dump-dmesg
as a workaround, to dump the kernel dmesg info with only vmcore
.
Jira:RHEL-52221[1]
8.9. File systems and storage
Support for NVMe devices has been removed from the lsscsi
package
Support for Non-volatile Memory Express (NVMe) devices has been removed from the lsscsi
package. Use native tools such as nvme-cli
, lsblk
, and blkid
instead. Report any missing functionality against the nvme-cli
package.
Jira:RHEL-32144[1]
Support for NVMe devices has been removed from the sg3_utils
package
Support for Non-volatile Memory Express (NVMe) devices has been removed from the sg3_utils
package. Use native tools such as the nvme-cli
package instead and report any missing functionality against nvme-cli
.
Jira:RHEL-412[1]
The VDO sysfs
parameters have been removed
The Virtual Data Optimizer (VDO) sysfs
parameters have been removed. Except for log_level
, all module-level sysfs
parameters for the kvdo
module are removed. For individual dm-vdo
targets, all sysfs
parameters specific to VDO are also removed. There is no change for the parameters that are common to all DM targets. Configuration values for dm-vdo
targets that are currently set by updating the removed module-level parameters, can no longer be changed.
Statistics and configuration values for dm-vdo
targets are no longer be accessible through sysfs
. But these values are still accessible by using dmsetup message stats
, dmsetup status
, and dmsetup table
dmsetup commands.
Jira:RHELDOCS-19066[1]
Support for GFS2 file systems has been removed
The Red Hat Enterprise Linux (RHEL) Resilient Storage Add-On will no longer be supported starting with Red Hat Enterprise Linux 10. This includes the GFS2 file system, which is also no longer supported. The RHEL Resilient Storage Add-On will continue to be supported with earlier versions of RHEL (7, 8, 9) and throughout their respective maintenance support lifecycles.
Jira:RHELDOCS-19024[1]
Support for the block translation table driver has been removed
Support for the block translation table driver (btt.ko) has been removed. As a consequence, you cannot use sector mode when configuring Non-Volatile Dual In-line Memory Modules (NVDIMM) namespaces.
Jira:RHEL-68504[1]
The nvme_core.multipath
parameter has been removed
In RHEL 10, the use of DM multipath with NVMe devices over RDMA and FC is no longer supported. As a consequence, the nvme_core.multipath
parameter has been removed, the native NVMe multipath is enabled by default, and it can no longer be disabled.
Bug fixes and support for using DM multipath with NVMe devices over RDMA and FC are provided only through the end of the RHEL 9 lifecycle. Note that DM multipath was never supported with NVMe over TCP in any version of RHEL.
Jira:RHEL-78133[1]
The md-faulty
and md-multipath
modules have been removed
In RHEL 10, the md-faulty
and md-multipath
MD RAID kernel modules are no longer available. Bug fixes and support are provided only through the end of the RHEL 9 lifecycle.
Jira:RHELDOCS-19828[1]
8.10. High availability and clusters
pcsd
Web UI no longer available as a standalone user interface
The pcsd
Web UI has been modified to be usable as a RHEL web console add-on and is no longer operated as a standalone interface.
Support for the RHEL Resilient Storage Add-On has been removed
The Red Hat Enterprise Linux (RHEL) Resilient Storage Add-On will no longer be supported starting with Red Hat Enterprise Linux 10 and any subsequent releases after RHEL 10. The RHEL Resilient Storage Add-On will continue to be supported with earlier versions of RHEL (7, 8, 9) and throughout their respective maintenance support lifecycles.
Jira:RHELDOCS-19023[1]
Removed and updated Pacemaker CIB elements
The following configuration components of the Pacemaker CIB have been removed or modified in RHEL 10. When you upgrade to RHEL 10, these components are automatically removed, modified, or replaced as described. Before you upgrade, ensure that the Pacemaker CIB has a supported value for the validate-with
attribute. Although you should not edit the cluster configuration file directly, you can view the raw cluster configuration with the pcs cluster cib
command.
An upgrade modifies the following CIB components:
-
The
validate-with
attribute of thecib
element, which is set topacemaker-4.0
-
The
stonith-action
cluster property, which is set tooff
if it was previously set topoweroff
-
Legacy promotable clone (master) resources, which are changed to standard promotable clones by changing the
master
xml element to theclone
xml element and by setting thepromotable
meta attribute - Location constraints with more than one top-level rule, which are converted to separate location constraints for each top-level rule
An upgrade renames the following components:
-
The
crmd-finalization-timeout
cluster property, which is renamed tojoin-finalization-timeout
-
The
crmd-integration-timeout
cluster property, which is renamed tojoin-integration-timeout
-
The
crmd-transition-delay
cluster property, which is renamed totransition-delay
An upgrade removes the following components from the CIB:
-
nagios-class
andupstart-class
resources -
bundle
resources based on anrkt
container. -
The
restart-type
resource meta-attribute -
The
can_fail
operation meta-attribute -
The
role_after_failure
operationmeta-attribute
-
moon
attributes indate_spec
elements of rules -
The
remove-after-stop
cluster property. - Ping nodes, which are changed to cluster member nodes with all resources banned and probes disabled
- NVpairs without a value attribute
- Duplicate NVpairs with a given name within an NVset, for which only the first NVpair is kept
An upgrade changes the following default values:
- An action configured as a fence device parameter is now ignored rather than treated as a default fencing action.
-
The
concurrent-fencing
cluster option now defaults totrue
and is deprecated. -
The
globally-unique
clone option now defaults totrue
whenclone-node-max
is greater than 1.
An upgrade removes lifetime
elements, and modifies the CIB as follows:
lifetime
elements in a location constraint are removed.-
If the
lifetime
element in a location constraint has no top-level rules, thelifetime
-based rule becomes the constraint’s top-level rule. -
If the
lifetime
element in a location constraint has multiple top-level rules, they are nested inside a singleor
rule. -
If the
lifetime
element in a location constraint has a single top-level rule, a new and top-level constraint rule is added that contains the existing top-level constraint rule and thelifetime
-based rule.
-
If the
-
lifetime
elements in a colocation or order constraint are removed. If any rules contained in the colocation or order constraint are referenced elsewhere, they are put in a new location constraint that does not apply to any resources. They are put in a location constraint since a rule in alifetime
element may contain a node attribute expression, which is now allowed only within a location constraint rule. - Following an upgrade, invalid fencing levels display a warning when the CIB is loaded.
Jira:RHELDOCS-19813[1]
Removed functionality for the Red Hat High Availability Add-On
The following Red Hat High Availability Add-On features are no longer supported in RHEL 10.
- RKT containers in bundles. Docker and Podman containers are still supported.
-
The
upstart
andnagios
resource classes. -
Location constraints with multiple top-level rules. Only one rule per constraint is allowed. The
pcs constraint rule add
,pcs constraint rule delete
and thepcs constraint rule remove
commands have been removed. If you have configured constraints with multiple rules, run thepcs cluster cib-upgrade
command to update to the latest CIB schema. During the update, Pacemaker creates a constraint for each rule, so that there will be only one rule in each constraint. -
The
monthdays
,moon
,weekdays
,weekyears
, andyearsdays
duration options for Pacemaker rules. - Using spaces in dates in location constraint rules.
-
Delimiting stonith devices with a comma in
pcs stonith level add | clear | delete | remove
commands. -
Ambiguous syntax of the
pcs stonith level clear | delete | remove
command. The command has been clarified to distinguish a target from a stonith device. -
The legacy role names of
master
andslave
are no longer accepted by thepcs
command-line interface. UsePromoted
,Unpromoted
, --promoted,promotable
, andpromoted-max
instead. -
Using stonith resources in
pcs resource
commands and resources inpcs stonith
commands, as well as the--brief
,--no-strict
,--safe
and--simulate
flags of thepcs stonith disable
command. -
Ability to create a stonith resource in a group with the
pcs stonith create
command. -
The
stonith.create_in_group
command from API v1 and v2. -
The
pcs cluster pcsd-status
command. Use thepcs status pcsd
orpcs pcsd status
command. -
The
pcs cluster certkey
command. Use thepcs pcsd certkey
command. -
The
pcs resource | stonith [op] defaults <name>=<value>…
command. Use thepcs resource | stonith [op] defaults update
command. -
The
pcs acl show
command. Use thepcs acl config
command. -
The
pcs alert show
command. Use thepcs alert config
command. -
The
pcs constraint [location | colocation | order | ticket] show | list
commands. Use thepcs constraint [location | colocation | order | ticket] config
command. -
The
pcs property show
and thepcs property list
commands. Use thepcs property config
command. -
The
pcs tag list
command. Use thepcs tag config
command. -
The
--autodelete
flag of thepcs resource move
command.
Jira:RHEL-49521, Jira:RHEL-62719, Jira:RHEL-49524, Jira:RHEL-49520
8.11. Compilers and development tools
32-bit packages have been removed in RHEL 10
Linking against 32-bit multilib packages has been removed. The *.i686
packages remain supported for the life cycle of Red Hat Enterprise Linux 9.
8.12. Identity Management
The pam_console
module has been removed
The pam_console
module has been removed from RHEL 10. The pam_console
module granted file permissions and authentication capabilities to users logged in at the physical console or terminals, and adjusted these privileges based on console login status and user presence. As an alternative to pam_console
, you can use the systemd-logind
system service instead. For configuration details, see the logind.conf(5)
man page.
Jira:RHELDOCS-18159[1]
The RSA PKINIT method has been removed
The private key-based RSA method is no longer supported in the MIT Kerberos. It has been removed for security reasons, especially for its vulnerability to the Marvin attack. As a result, the -X flag_RSA_PROTOCOL
parameter of the kinit
commands has no effect anymore. The Diffie-Hellman key agreement method is used as the default PKINIT mechanism.
Jira:RHEL-56070[1]
The NIS server emulator has been removed
RHEL Identity Management (IdM) does not provide the NIS functionality anymore.
Other removed functionality for RHEL Identity Management
The following packages were part of RHEL 9 but are not distributed with RHEL 10:
-
compat-hesiod
-
fontawesome-fonts
: consider usingfontawesome4-fonts
instead -
libnsl2
-
python3-netifaces
: consider usingpython-ifaddr
instead
BDB is no longer supported in 389-ds-base
The libdb
library that implements the Berkeley Database (BDB) version used by 389-ds-base
is no longer available in RHEL 10. As a result, Directory Server no longer supports BDB.
As a replacement, Directory Server creates instances with Lightning Memory-Mapped Database (LMDB).
8.13. SSSD
The enumeration
feature has been removed for AD and IdM
Support for the enumeration
feature was deprecated for AD and IdM in Red Hat Enterprise Linux (RHEL) 9. The enumeration
feature has been removed for AD and IdM in RHEL 10.
The libsss_simpleifp
subpackage has been removed
The libsss_simpleifp
subpackage that provided the libsss_simpleifp.so
library was deprecated in Red Hat Enterprise Linux (RHEL) 9. The libsss_simpleifp
subpackage has been removed in RHEL 10.
The SSSD files provider has been removed
The SSSD files provider has been removed from RHEL 10.0. Previously, the SSSD files provider was responsible for smart card authentication and session recording for local users. As a replacement, you can configure the SSSD proxy provider.
Due to the removal of the files provider, the authselect
minimal
profile has been replaced by a new local
profile.
Jira:RHELDOCS-19267[1]
The ad_allow_remote_domain_local_groups
option has been removed from SSSD
Support for the ad_allow_remote_domain_local_groups
option in sssd.conf
was deprecated in Red Hat Enterprise Linux (RHEL) 9.6. The ad_allow_remote_domain_local_groups
option has been removed in RHEL 10.
Jira:RHEL-68319[1]
The reconnection_retries
option has been removed
The reconnection_retries
option has been removed from the sssd.conf
file in SSSD in RHEL 10.0. Because SSSD switched to a new architecture using internal IPC between SSSD processes and responders no longer connect to the backend, the reconnection_retries
option is no longer used.
Jira:RHELDOCS-18965[1]
8.14. Desktop
TigerVNC has been removed
The TigerVNC remote desktop solution has been removed in RHEL 10.
TigerVNC provided the server and client implementation of the Virtual Network Computing (VNC) protocol in RHEL 9.
The following packages have been removed:
-
tigervnc
-
tigervnc-icons
-
tigervnc-license
-
tigervnc-selinux
-
tigervnc-server
-
tigervnc-server-minimal
-
tigervnc-server-module
The Connections application (gnome-connections
) continues to be supported as an alternative VNC client, but it does not provide a VNC server. TigerVNC is replaced by the gnome-remote-desktop
daemon, which is a remote desktop server that uses the RDP protocol. You can use the gnome-remote-desktop
in the following modes:
- Desktop sharing: provides sharing of your physical session by using Assisted Access
- Headless session: provides a single user remote headless session
- Remote login: provides a graphical remote login and replaces functionality of XDMCP
Jira:RHELDOCS-18388[1]
Totem media player has been removed in RHEL 10
The RHEL 10 installation does not contain any media player by default. You can use any third party media player available, for example, on Flathub.
Jira:RHELDOCS-18389[1]
power-profiles-daemon
is removed in RHEL 10
The power-profiles-daemon
package that provided power mode configuration in GNOME has been removed in RHEL 10. In RHEL 10, you can manage power profiles with the Tuned daemon.
The tuned-ppd
package provides a drop-in replacement for power-profiles-daemon
, which allows it to be used with GNOME desktop and applications that use power-profiles-daemon
API. You can also use it to override the three basic power profiles, including power-saver
, balanced
, and performance
through the /etc/tuned/ppd.conf
configuration file. If you want to use a customized profile, you can edit the configuration file and map the custom profile to the three basic power-profiles-daemon
profile names.
Jira:RHELDOCS-18390[1]
gedit
is removed in RHEL 10
gedit
, the default graphical text editor in Red Hat Enterprise Linux, is removed in RHEL 10. As an alternative, you can use GNOME Text Editor.
Jira:RHELDOCS-19148[1]
Tweaks is no longer available as a RHEL package in RHEL 10
Instead of the Tweaks desktop application, you can use the default GNOME Settings app, which has been expanded to include many options previously only found in Tweaks.
Jira:RHELDOCS-19125[1]
Qt5 libraries are removed in RHEL 10
Qt5 libraries are replaced with Qt6 libraries, with new functionality and better support.
For more information, see Porting to Qt 6.
Jira:RHELDOCS-19132[1]
WebKitGTK is removed in RHEL 10
The WebKitGTK web browser engine is removed in RHEL 10. As a consequence, you can no longer build applications that depend on WebKitGTK. Desktop applications other than Firefox can no longer display web content. There is no alternative web browser engine provided in RHEL 10.
Jira:RHELDOCS-19170[1]
Evolution is removed in RHEL 10
Evolution is a GNOME application that provides integrated email, calendar, contact management, and communications functionality. The application and its plugins are removed in RHEL 10. You can find an alternative in a third party source, for example on Flathub.
You can back up your Evolution data directly in Evolution using the Back up Evolution data
item in the File
menu.
Jira:RHELDOCS-19146[1]
Festival is not supported in RHEL 10
With support for the Festival speech synthesizer removed in RHEL 10, the Festival binaries, libraries and the plugin for Speech Dispatcher are also removed.
As an alternative, you can use the Espeak NG speech synthesizer.
Jira:RHELDOCS-19138[1]
The Eye of GNOME is removed
The Eye of GNOME (eog
) image viewer application is removed in RHEL 10.
As an alternative, you can use the Loupe application.
Jira:RHELDOCS-19134[1]
Cheese is removed
The Cheese camera application is removed in RHEL 10.
As an alternative, you can use the Snapshot application.
Jira:RHELDOCS-19136[1]
Devhelp has been removed
Devhelp, a graphical developer tool for browsing and searching API documentation, has been removed in RHEL 10. You can now find API documentation online in specific upstream projects.
Jira:RHELDOCS-19153[1]
gtkmm
based on GTK 3 has been removed
gtkmm
is a C++ interface for the GTK graphical toolkit. The gtkmm
version that was based on GTK 3 has been removed in RHEL 10 with all its dependencies. To access gtkmm
in RHEL 10, migrate to the gtkmm
version based on GTK 4.
Jira:RHELDOCS-19142[1]
LibreOffice is removed in RHEL 10
The LibreOffice RPM packages are removed from RHEL 10. LibreOffice continues to be fully supported through the entire life cycle of RHEL 7, 8, and 9.
As a replacement for the RPM packages, Red Hat recommends that you install LibreOffice from either of the following sources provided by The Document Foundation:
The official Flatpak package in the Flathub repository: link:https://flathub.org/apps/org.libreoffice.LibreOffice. The official RPM packages: link:https://www.libreoffice.org/download/download-libreoffice/.
Jira:RHELDOCS-19152[1]
GNOME Terminal is removed in RHEL 10
GNOME Terminal has been replaced with Ptyxis in RHEL 10.
Ptyxis is a container-oriented terminal that provides transparent support for container systems like Podman or Toolbx and robust support for user profiles.
Jira:RHELDOCS-19155[1]
Inkscape vector graphics editor is removed in RHEL 10
The RHEL 10 installation does not contain any vector graphics editor. You can use any third party vector graphics editor available, for example, on Flathub.
Jira:RHELDOCS-19150[1]
GNOME Classic session has been removed from the default installation
If your scenario requires the GNOME classic session, install it manually:
Install the
gnome-classic-session
package:dnf install gnome-classic-session
# dnf install gnome-classic-session
Copy to Clipboard Copied! - Log out of your current session.
- On the login screen (GDM), click the gear icon next to your username.
- Select "GNOME Classic" from the session list.
- Log in as usual.
Evince is removed in RHEL 10
Evince, a document viewer for the GNOME desktop, is removed in RHEL 10. You can use the Papers application instead. Papers is a fork of Evince ported to Gtk 4, which aims to move at a more rapid pace with adding of new features, such as listing of signatures in PDF documents. Papers is partially written in Rust for improved stability.
Jira:RHELDOCS-19140[1]
8.15. Graphics infrastructures
The PulseAudio daemon is removed in RHEL 10
The PulseAudio daemon, and its packages pulseaudio
and alsa-plugins-pulseaudio
, have been removed in RHEL 10.
Note that the PulseAudio client libraries and tools are not deprecated, this change only impacts the audio daemon that runs on the system.
You can use the PipeWire audio system as a replacement, which has also been the default audio daemon since RHEL 9.0. PipeWire also provides an implementation of the PulseAudio APIs.
Jira:RHELDOCS-17682[1]
Motif is removed
Motif is an X11-based Desktop Environment (DE), which consists of a toolkit and the mwm
X11 window manager. It was previously deprecated and has been removed from RHEL 10. As a replacement, you can use the GTK or Qt toolkit.
Jira:RHELDOCS-19221[1]
xorg-x11-server
is removed from RHEL 10
The X.Org server, an implementation of the X Window System, was previously deprecated and is removed from RHEL 10. Note that the X11 protocol is not removed, which means that most applications will remain compatible through the Xwayland compositor. For more information, see Red Hat Enterprise Linux 10 plans for Wayland and Xorg server (Red Hat Blog).
Jira:RHELDOCS-19222[1]
8.16. Red Hat Enterprise Linux System Roles
The mssql_accept_microsoft_odbc_driver_17_for_sql_server_eula
variable has been deprecated
With a future major update of RHEL, the mssql_accept_microsoft_odbc_driver_17_for_sql_server_eula
variable will no longer be supported in the mssql
system role because the role can now install the odbc
driver for mssql_tools
version 17 and 18. Therefore, you must use the mssql_accept_microsoft_odbc_driver_for_sql_server_eula
variable without the version number instead.
Important: If you use the deprecated variable with the version number mssql_accept_microsoft_odbc_driver_17_for_sql_server_eula
, the role notifies you to use the new variable mssql_accept_microsoft_odbc_driver_for_sql_server_eula
. However, the deprecated variable continues to work.
8.17. Virtualization
The virt-v2v
tool can no longer convert Xen virtual machines from RHEL 5
It is no longer possible to use the virt-v2v
tool to convert virtual machines from a RHEL 5 Xen host to KVM. For details, see the Red Hat Knowledge Base.
Red Hat Virtualization compatibility has been removed from virt-v2v
Because the maintenance support for Red Hat Virtualization (RHV) has ended, the virt-v2v
utility no longer supports exporting virtual machines to RHV. As a consequence, the following options are no longer available in virt-v2v
:
-
-o rhv-upload
-
-o rhv
-
-o vdsm
Persistent memory device passthrough cannot be used in RHEL 10
Because the nvml
package was removed in RHEL 10, persistent memory (pmem
) device passthrough cannot be used anymore. pmem
device passthrough allows a virtual machine to directly access a host’s physical persistent memory hardware with minimal emulation overhead.
RDMA-based migration is unsupported
In RHEL 10, migrating virtual machines (VMs) by using Remote Direct Memory Access (RDMA) is no longer supported. Therefore, Red Hat highly discourages using the rdma
URI for VM migration.
NIC device drivers related to iPXE have been removed
The Internet Preboot eXecution Environment (iPXE) firmware provides a range of network boot options for remotely booting machines. iPXE also provides a large number of device drivers. The following iPXE drivers are no longer in use in the RHEL 10 release, and have therefore been removed:
-
The complete
ipxe-roms
sub-RPM package Binary files containing device drivers from
ipxe-bootimgs-x86
sub-RPM package:-
/usr/share/ipxe/ipxe-i386.efi
-
/usr/share/ipxe/ipxe-x86_64.efi
-
/usr/share/ipxe/ipxe.dsk
-
/usr/share/ipxe/ipxe.iso
-
/usr/share/ipxe/ipxe.lkrn
-
/usr/share/ipxe/ipxe.usb
-
Instead, iPXE now depends on the platform firmware to provide a NIC driver for the network boot. The /usr/share/ipxe/ipxe-snponly-x86_64.efi
and /usr/share/ipxe/undionly.kpxe
iPXE binary files are a part of the ipxe-bootimgs
package and use the NIC driver provided by the platform firmware.
8.18. RHEL in cloud environments
cloud-init
no longer uses python-jsonschema
This update has removed the cloud-init
dependency on the python-jsonschema
package. As a consequence, it is no longer possible use the cloud-init
schema validator to verify cloud-init
configuration.
Jira:RHEL-65849[1]
8.19. Containers
The rsyslog
container image has been removed
The rsyslog
container image has been removed. Instead, you can use the support-tools container
image, which includes diagnostic and troubleshooting tools such as sos report
, strace
, and tcpdump
. With the support-tools
image, you can have access to many of the functionalities previously covered by the rsyslog
image, along with additional utilities to enhance system support and maintenance workflows.
Jira:RHELDOCS-19363[1]
The cgroupv1
has been removed
The cgroupv1
control group mechanism has been removed, use cgroupv2
instead. The cgroupv2
provides a single control group hierarchy against which all resource controllers are mounted. The default in RHEL 10 is cgroupv2
.
The runc container runtime has been removed
The runc
container runtime has been removed. The container runtime in RHEL 10 is crun. The crun is a fast and low-memory footprint OCI container runtime written in C. The crun binary is up to 50 times smaller and up to twice as fast as the runc binary. Using crun, you can also set a minimal number of processes when running your container. The crun runtime also supports OCI hooks.
Chapter 9. Deprecated features
Deprecated functionalities are fully supported, which means that they are tested and maintained, and their support status remains unchanged within Red Hat Enterprise Linux 10. However, they will likely not be supported in a future major version release, and are not recommended for new deployments on the current or future major versions of Red Hat Enterprise Linux.
Features can be deprecated during a major version’s release cycle.
A deprecated feature is listed in all future release notes until it is removed. For a complete list of deprecated features, see the release notes for the latest minor version. For information about the length of support, see Red Hat Enterprise Linux Life Cycle and Red Hat Enterprise Linux Application Streams Life Cycle.
9.1. Installer and image creation
The cockpit-composer
package has been deprecated
The cockpit-composer
package has been deprecated, and will be removed in future major RHEL releases. From now on, use cockpit-image-builder
.
Jira:RHELDOCS-20167[1]
The squashfs
package has been deprecated
The squashfs
package has been deprecated, and will be removed in a future major RHEL release. As an alternative, dracut
has support for mounting erofs
.
Jira:RHELDOCS-18903[1]
gdisk
has been deprecated from the boot.iso
gdisk
has been deprecated from the boot.iso
image type. You still can use gdisk
in your kickstarts. For the boot.iso
image type, other tools are available for handling GPT disks, for example, the parted
utility.
Jira:RHELDOCS-18904[1]
The module kickstart command has been deprecated
Anaconda has deprecated its support for DNF modularity, and as a consequence the module
kickstart command has been deprecated. This might impact you if you are using modules in the %packages
section of your kickstart files or the module
kickstart command. This change is implemented for simplifying the installation process and ensuring a more consistent experience moving forward.
The inst.gpt
boot option is now deprecated
The inst.gpt
boot option is now deprecated and will be removed in the future releases. To specify a preferred disk label type, use the inst.disklabel
boot option. Specify gpt
or mbr
to create GPT or MBR disk labels, respectively.
Jira:RHELDOCS-18491[1]
9.2. Security
ENGINE API in OpenSSL is deprecated
In RHEL 10, ENGINE API is deprecated and is planned to be removed in a future major release. No new applications should be built by using the ENGINE API. To keep application binary interface (ABI) and existing applications working, OpenSSL still exports the ENGINE symbols. To prevent new applications from using ENGINE API, OpenSSL sets the OPENSSL_NO_ENGINE
flag system-wide, and the header engine.h
that exposes the ENGINE API has been removed.
crypto-policies
now set allow-rsa-pkcs1-encrypt = false
for GnuTLS
In RHEL 10, the GnuTLS library blocks encryption and decryption with the RSA PKCS #1 v1.5 padding by default. Except for the LEGACY policy, the allow-rsa-pkcs1-encrypt = false
option is specified in all system-wide cryptographic policies (DEFAULT, FUTURE, and FIPS).
HMAC-SHA-1 in FIPS mode is deprecated
The HMAC-SHA-1 cryptographic algorithm is deprecated in FIPS mode, and it may be removed in a future release. Outside FIPS mode, support for HMAC-SHA-1 is preserved.
9.3. Networking
ipset
has been unmaintained
In RHEL 10, the ipset
utility is unmaintained and is planned to be removed in a future major release. Red Hat will provide only critical bug fixes during the current release lifecycle. As an alternative to ipset
, you can use the nftables
sets functionality instead.
Jira:RHELDOCS-20147[1]
9.4. File systems and storage
The squashfs
package has been deprecated
SquashFS is deprecated and will be removed in the next major release. It will no longer receive enhancements and is in RHEL 10 for specific use cases that are internal to Red Hat. Consider using EROFS as an alternative solution.
Jira:RHELDOCS-18450[1]
9.5. High availability and clusters
Deprecated High Availability Add-On features
The following features have been deprecated in Red Hat Enterprise Linux 10 and will be removed in the next major release:
- Specifying rules as multiple arguments. Use a single string argument instead.
-
Specifying
score
as a standalone value inpcs constraint location add
andpcs constraint colocation ad
. Usescore=value
instead. Specifying the
--wait
option in resource commands exceptpcs resource restart | move
, and in the commandspcs cluster node add-guest | add-remote
. Use the following commands instead:-
pcs status wait
to wait for the cluster to settle into stable state. -
pcs status query resource
commands to verify that the resource is in the expected state after the wait.
-
-
Using the
--force
flag to confirm potentially destructive actions such aspcs cluster destroy
,pcs quorum unblock
,pcs stonith confirm
,pcs stonith sbd device setup
, andpcs stonith sbd watchdog test
commands. You should now use the--yes
flag to confirm potentially destructive actions and reserve use of the--force
flag to override validation errors. -
Using the
--force
flag to confirm overwriting files inpcs cluster report
. Use the--overwrite
flag instead. -
Assigning and unassigning ACL roles without specifying the
user
orgroup
keyword. -
Configuring a score parameter in order constraints. The
pcs
command-line interface now produces a warning when a user attempts to configure a score parameter in order constraints.
Jira:RHELDOCS-19607[1]
9.6. Compilers and development tools
The utmp
and utmpx
interfaces in glibc
are deprecated
The utmp
and utmpx
interfaces provided by the glibc
library include a counter that counts time since the Unix epoch. This counter will overflow on February 07, 2106. Therefore, utmp
and utmpx
are deprecated in RHEL 10 and will be removed in RHEL 11.
Jira:RHELDOCS-18080[1]
9.7. The web console
The host switcher in the RHEL web console is deprecated
The host switcher that provides connections to multiple machines through SSH from a single RHEL web console session is deprecated and disabled by default. Due to the web technology limitations, this feature cannot be secure.
In the short term, you can enable the host switcher after assessing the risks in your scenario with the AllowMultiHost
option in the cockpit.conf
file:
[WebService] AllowMultiHost=yes
[WebService]
AllowMultiHost=yes
As more secure alternatives, you can use:
- the web console login page (with the secure limit of one host in a web browser session)
- the Cockpit Client flatpack
Jira:RHEL-4032[1]
9.8. Red Hat Enterprise Linux System Roles
The sshd
variable deprecated and replaced by sshd_config
To unify coding standards across the RHEL system roles, the sshd
variable has been replaced by the sshd_config
variable. The sshd
variable is now deprecated and may be removed from the sshd
Ansible role in a future major version of RHEL.
Jira:RHEL-73440[1]
9.9. Virtualization
libslirp has been deprecated
In RHEL 10, the libslirp
networking back end has become deprecated, and will be removed in a future major version release.
The i440fx virtual machine type has been deprecated
In RHEL 10, the i440fx
machine types for virtual machines (VMs) have become deprecated, and will be removed in a future major version of RHEL.
In addition, the i440fx-rhel7.6
machine type has been replaced by i440fx-rhel10.0
. As a consequence, a VM with a i440fx-rhel7.6
machine type will not boot correctly after live migrating to a RHEL 10 host. Workaround: Restart the VM after live migration.
Jira:RHELDOCS-18672[1]
Legacy vCPU models are now deprecated
Several virtual CPU models are now deprecated and will become unsupported for use in virtual machines (VMs) in a future major release of RHEL. Notably, the deprecated models include the following:
- Intel Xeon 55xx and 75xx Processor families (also known as Nehalem)
- Intel Xeon v2 (also known as Ivy Bridge)
- AMD Opteron G4 and G5
To view the complete list of deprecated CPU models, use the following command:
/usr/libexec/qemu-kvm -cpu help | grep depre | grep -v - -v
# /usr/libexec/qemu-kvm -cpu help | grep depre | grep -v - -v
To check whether a running VM is using a deprecated CPU model, use the virsh dominfo
utility, and look for a line similar to the following in the Messages
section:
tainted: use of deprecated configuration settings deprecated configuration: CPU model 'Nehalem'
tainted: use of deprecated configuration settings
deprecated configuration: CPU model 'Nehalem'
Jira:RHEL-28971[1]
virt-manager
has been deprecated
The Virtual Machine Manager application, also known as virt-manager
, has been deprecated. The RHEL web console, also known as Cockpit
, is intended to become its replacement in a subsequent release. It is, therefore, recommended that you use the web console for managing virtualization in a GUI. Note, however, that some features available in virt-manager
might not be yet available in the RHEL web console.
Jira:RHELPLAN-10304[1]
libvirtd
has become deprecated
The monolithic libvirt
daemon, libvirtd
, has been deprecated in RHEL 9, and will be removed in a future major release of RHEL. Note that you can still use libvirtd
for managing virtualization on your hypervisor, but Red Hat recommends switching to the newly introduced modular libvirt
daemons. For instructions and details, see the RHEL 9 Configuring and Managing Virtualization document.
Jira:RHELPLAN-113995[1]
SecureBoot image verification using SHA1-based signatures is deprecated
Performing SecureBoot image verification using SHA1-based signatures on UEFI (PE/COFF) executables has become deprecated. Instead, Red Hat recommends using signatures based on the SHA-2 algorithm, or later.
Jira:RHELPLAN-69533[1]
The virtual floppy driver has become deprecated
The isa-fdc
driver, which controls virtual floppy disk devices, is now deprecated, and will become unsupported in a future release of RHEL. Therefore, to ensure forward compatibility with migrated virtual machines (VMs), Red Hat discourages using floppy disk devices in VMs hosted on RHEL 10.0.
Jira:RHELPLAN-81033[1]
qcow2-v2 image format is deprecated
With RHEL 10.0, the qcow2-v2 format for virtual disk images has become deprecated, and will become unsupported in a future major release of RHEL. In addition, the RHEL 10.0 Image Builder cannot create disk images in the qcow2-v2 format.
Instead of qcow2-v2, Red Hat strongly recommends using qcow2-v3. To convert a qcow2-v2 image to a later format version, use the qemu-img amend
command.
Jira:RHELPLAN-75969[1]
9.10. Containers
The runc
container runtime has been removed
The runc
container runtime is removed. The default container runtime is crun
. If you upgrade from the previous RHEL versions to RHEL 10.0, you have to run the podman system migrate --new-runtime=crun
command to set a new OCI runtime for all containers.
Jira:RHELDOCS-19051[1]
tzdata
package is no longer installed by default in the minimal container images
The tzdata
package is no longer installed in the registry.access.redhat.com/ubi10-minimal
container image. As a consequence, if you migrate your minimal container builds from a previous RHEL release to RHEL 10.0, and you enter the microdnf reinstall tzdata
command to reinstall the tzdata
package, you get an error message because the tzdata
package is no longer installed by default. In this case, enter the microdnf install tzdata
command to install tzdata
.
Jira:RHELDOCS-18700[1]
The Podman v5.0 deprecations
In RHEL 10.0, the following is deprecated in Podman v5.0:
-
The system connections and farm information stored in the
containers.conf
file are now read-only. The system connections and farm information will now be stored in thepodman.connections.json
file, managed only by Podman. Podman continues to support the old configuration options such as[engine.service_destinations]
and the[farms]
section. You can still add connections or farms manually if needed; however, it is not possible to delete a connection from thecontainers.conf
file with thepodman system connection rm
command. -
The
slirp4netns
network mode is deprecated and will be removed in a future major release of RHEL. Thepasta
network mode is the default network mode for rootless containers. The
containernetworking-plugins
package and the CNI network stack are no longer supported.-
If you upgrade from the previous RHEL versions to RHEL 10.0 or if you have a fresh installation of RHEL 10.0, the CNI is no longer available. As a result, you have to run the
podman rmi --all --force
command to remove all images and containers that are using those images. -
If present, the
cni
value in the containers.conf file for thenetwork_backend
option must be changed tonetavark
or can be unset.
-
If you upgrade from the previous RHEL versions to RHEL 10.0 or if you have a fresh installation of RHEL 10.0, the CNI is no longer available. As a result, you have to run the
The podman-tests
package has been deprecated
The podman-tests
package has been deprecated in the AppStream repository. The package is now available in the CodeReady Linux Builder (CRB). More information about the CRB repository can be found at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/package_manifest/repositories#CodeReadyLinuxBuilder-repository.
nodejs-18
and nodejs-18-minimal
are deprecated
The nodejs-18
and nodejs-18-minimal
container images are now deprecated and will no longer receive feature updates. Use nodejs-22
and nodejs-22-minimal
instead.
Jira:RHELDOCS-20283[1]
9.11. Deprecated features identified in previous releases
This part provides an overview of functionality that has been deprecated in Red Hat Enterprise Linux 10.
9.11.1. SSSD
The SMB1 protocol is deprecated in Samba
Starting with Samba 4.11, the insecure Server Message Block version 1 (SMB1) protocol is deprecated and will be removed in a future release.
To improve the security, by default, SMB1 is disabled in the Samba server and client utilities.
Jira:RHELDOCS-16612[1]
9.12. Deprecated packages
This section lists packages that have been deprecated and will probably not be included in a future major release of Red Hat Enterprise Linux.
The support status of deprecated packages remains unchanged within RHEL 10.
The following packages have been deprecated in RHEL 10:
- daxio
- gvisor-tap-vsock-gvforwarder
- libpmem
- libpmem2
- libpmemblk
- libpmemlog
- libpmemobj
- libpmemobj-cpp
- libpmempool
- libslirp
- nvml
- pmempool
- pmreorder
- sdl2-compat
- wget
Chapter 10. Known issues
This version of Red Hat Enterprise Linux 10.0 is affected by the following newly identified and previously known issues. A known issue is listed in all future release notes until resolved, at which point it is published as a fixed issue. If you encountered an issue that is not listed in this section, please report it by using the button in the top right corner of this page.
10.1. Installer and image creation
Unable to build ISOs from a signed container
Trying to build an ISO disk image from a GPG or a simple signed container results in an error, similar to the following:
manifest - failed Failed Error: cannot run osbuild: running osbuild failed: exit status 1 2024/04/23 10:56:48 error: cannot run osbuild: running osbuild failed: exit status 1
manifest - failed
Failed
Error: cannot run osbuild: running osbuild failed: exit status 1
2024/04/23 10:56:48 error: cannot run osbuild: running osbuild failed: exit status 1
This happens because the system fails to get the image source signatures.
Workaround: You can either remove the signature from the container image or build a derived container image. For example, to remove the signature, you can run the following command:
sudo skopeo copy --remove-signatures containers-storage:registry.redhat.io/rhel9/rhel-bootc:9.4 containers-storage:registry.redhat.io/rhel9/rhel-bootc:9.4 sudo podman run \ --rm \ -it \ --privileged \ --pull=newer \ --security-opt label=type:unconfined_t \ -v /var/lib/containers/storage:/var/lib/containers/storage \ -v ~/images/iso:/output \ quay.io/centos-bootc/bootc-image-builder \ --type iso --local \ registry.redhat.io/rhel9/rhel-bootc:9.4
$ sudo skopeo copy --remove-signatures containers-storage:registry.redhat.io/rhel9/rhel-bootc:9.4 containers-storage:registry.redhat.io/rhel9/rhel-bootc:9.4
$ sudo podman run \
--rm \
-it \
--privileged \
--pull=newer \
--security-opt label=type:unconfined_t \
-v /var/lib/containers/storage:/var/lib/containers/storage \
-v ~/images/iso:/output \
quay.io/centos-bootc/bootc-image-builder \
--type iso --local \
registry.redhat.io/rhel9/rhel-bootc:9.4
To build a derived container image, and avoid adding a simple GPG signatures to it, see the Signing container images product documentation.
Hostname resolution fails with encrypted DNS and custom CA in boot options
While using the inst.repo=
or inst.stage2=
boot options in the kernel command line along with a remote installation URL, an encrypted DNS, and a custom CA certificate in the kickstart file, the installer attempts to download the install.img
stage2 image before processing the kickstart file. Consequently, the hostname resolution fails, leading to display of some errors before successfully fetching the stage2 image. Workaround: Define the installation source in the kickstart file instead of the kernel command line.
Installer becomes unresponsive during final RPM installation stage
An installer may become unresponsive during the RPM installation process at the final stage. Before the issue occurs, you may see the repeated Configuring rootfiles.noarch
messages. Workaround: Restart the installation process.
Jira:RHEL-67865[1]
Disabled keyboard layout switching by using shortcut during installation
To prevent confusion caused by a broken keyboard shortcut to change keyboard layout, this feature has been disabled in Anaconda. You cannot change keyboard layouts by using shortcuts during installation. Workaround: Use the keyboard layout icon on the top bar to switch layouts.
Bonding device with LACP takes longer to become operational, causing subscription failures
When configuring a bonding device with LACP by using both kernel command-line boot options and a Kickstart file, the connection is created during the initramfs
stage but reactivated in Anaconda. As a consequence, it causes a temporary disruption that leads to system subscription failure via the rhsm
Kickstart command.
Workaround: Add --no-activate
to the Kickstart network configuration to keep the network operational. As a result, the system subscription completes successfully.
Jira:RHELDOCS-19853[1]
The services
Kickstart command fails to disable the firewalld
service
A bug in Anaconda prevents the services --disabled=firewalld
command from disabling the firewalld
service in Kickstart. Workaround: Use the firewall --disabled
command instead. As a result, the firewalld
service is disabled properly.
Installation program fails if /boot
partition is not created when using ostreecontainer
When using the ostreecontainer
Kickstart command to install a bootable container, the installation fails if the /boot
partition is not created. This issue occurs because the installation program requires a dedicated /boot
partition to proceed with the container deployment.
Workaround: Ensure that a /boot
partition is defined in the Kickstart file or manually created during the installation process.
Kickstart installation fails with an unknown disk error when 'ignoredisk' command precedes 'iscsi' command
Installing RHEL by using the kickstart method fails if the ignoredisk
command is placed before the iscsi
command. This issue occurs because the iscsi
command attaches the specified iSCSI device during command parsing, while the ignoredisk
command resolves device specifications simultaneously. If the ignoredisk
command references an iSCSI device name before it is attached by the iscsi
command, the installation fails with an "unknown disk" error.
Workaround: Ensure that the iscsi
command is placed before the ignoredisk
command in the Kickstart file to reference the iSCSI disk and enable successful installation.
The USB CD-ROM drive is not available as an installation source in Anaconda
Installation fails when the USB CD-ROM drive is the source for it and the Kickstart ignoredisk --only-use=
command is specified. In this case, Anaconda cannot find and use this source disk.
Workaround: Use the harddrive --partition=sdX --dir=/
command to install from USB CD-ROM drive. As a result, the installation does not fail.
Driver disk menu fails to display user inputs on the console
When you start RHEL installation using the inst.dd
option on the kernel command line with a driver disk, the console fails to display the user input. Consequently, it appears that the application does not respond to the user input and stops responding, but displays the output which is confusing for users. However, this behavior does not affect the functionality, and user input gets registered after pressing Enter
.
Workaround: To see the expected results, ignore the absence of user inputs in the console and press Enter
when you finish adding inputs.
Anaconda may not work correctly on s390x
and ppc64le
architectures
Image mode for RHEL supports pp64le
and s390x
architectures besides the already supported x86_64
and ARM architectures. However, Anaconda may not function correctly on s390x and ppc64le architectures.
Jira:RHELDOCS-19496[1]
Anaconda installer appears as unresponsive in the rescue mode
When booting into a rescue mode and selecting the Continue
or Skip to shell
options, you might experience an issue where the Anaconda installer appears to be frozen. Despite the lack of visible response, the installer is still functional and reacting to your inputs; however, the prompt does not display on the screen, leading to confusion.
Continue with your tasks as normal, as the installer is still operational despite the absence of a visible prompt.
Jira:RHEL-58834[1]
10.2. Security
SELinux policy rules for four libvirt
services temporarily changed into permissive mode
Previously, the SELinux policy was changed to reflect the replacement of the legacy monolithic libvirtd
daemon with a new set of modular daemons. Because this change requires testing of a lot of scenarios, the following services have been temporarily changed into SELinux permissive mode:
-
virtqemud
-
virtvboxd
-
virtstoraged
-
virtsecretd
To prevent harmless AVC denials, dontaudit
rules have been added to the SELinux policy for these services.
Jira:RHEL-77808[1]
Cryptographic tokens do not work in FIPS mode with pkcs11-provider
When the system runs in FIPS mode, the pkcs11-provider
OpenSSL provider does not work correctly and the OpenSSL TLS toolkit falls back to the default provider. Consequently, OpenSSL fails to load PKCS #11 keys, and cryptographic tokens do not work in this scenario.
Workaround: Set the pkcs11-module-assume-fips = true
parameter in the PKCS #11 section of the openssl.cnf
file. See the pkcs11-provider(7)
man page on your system for more information. With this configuration change, pkcs11-provider
works in FIPS mode.
10.3. Shells and command-line tools
pass:uname
command produces an unknown output
The uname command displays unknown output with flags pass:--hardware-platform
and pass:--processor
. In the previous RHEL versions, pass:uname -i
and pass:uname -p
were aliases for pass:uname -m
and are not portable even across GNU/Linux distributions.
As a workaround, you can use the pass:-m
flag instead of the pass:-i
and pass:-p
flags.
10.4. Infrastructure services
Nginx does not support PKCS #11 and TPM
The OpenSSL engines API was deprecated in RHEL 9 and removed from Nginx in RHEL 10. The corresponding functionality using the current OpenSSL providers API is not yet available. As a consequence, the Nginx HTTP server does not work with hardware security modules (HSMs) through PKCS #11 and Trusted Platform Module (TPM) devices.
Using the incorrect Perl database driver for MariaDB and MySQL can lead to unexpected results
The MariaDB database is a fork of MySQL. Over time, these services developed independently and are no longer fully compatible. These differences also affect the Perl database drivers. Consequently, if you use the DBD::mysql
driver in a Perl application to connect to a MariaDB database, or the DBD::MariaDB
driver to connect to a MySQL database, operations can lead to unexpected results. For example, the driver can return incorrect data from read operations. To avoid such problems, use the Perl driver in your application that matches the database service.
Red Hat only supports the following scenarios:
-
The Perl
DBD::MariaDB
driver with a MariaDB database -
The Perl
DBD::mysql
driver with a MySQL database
Note that RHEL 8 contained only the DBD::mysql
driver. If you plan to upgrade to RHEL 9 and then to RHEL 10 and your application uses a MariaDB database, install the perl-DBD-MariaDB
package after the upgrade and modify your application to use the DBD::MariaDB
driver.
For further details, see the Red Hat Knowledgebase solution Support of MariaDB/MySQL cross-database connection from Perl db drivers.
Jira:RHELDOCS-19770[1]
VMware vCenter cannot correctly remove a SATA disk from a running RHEL VM
When using the VMWare vCenter interface to remove a SATA disk from a running RHEL 10 guest on the VMware ESXi hypervisor, the disk currently does not get removed fully. It stops being functional and disappears from the guest in the vCenter inteface, but the SCSI interface still detects the disk as attached in the guest.
Jira:RHEL-79913[1]
10.5. Networking
The wpa_supplicant
service no longer relies on the OpenSSL Engine API
In RHEL 10, engines are not compatible according to Federal Information Processing Standards (FIPS) therefore the corresponding OpenSSL Engine API has been removed. Consequently, the dependent wpa_supplicant
service cannot load X509 certificates and keys that are stored in PKCS11 URI format. As a result, any EAP-TLS authentication method and variants using PKCS11 will not be able to connect to the relevant network anymore.
The kernel can panic if you reduce the number of SR-IOV VFs at runtime
If all of the following conditions apply, the Linux kernel can panic:
- The host has Input-Output Memory Management Unit (IOMMU) enabled.
- A network driver uses a page pool.
- You reduce the number of Single Root I/O Virtualization (SR-IOV) Virtual Functions (VFs) of the network interface that uses this driver.
Workaround: Do not reduce the number of VFs at runtime. Reboot the machine to reset the number of VFs of all interfaces to 0. Afterwards, you can set a new number of VFs because increasing the number does not cause the kernel panic.
Jira:RHEL-68401[1]
10.6. Kernel
crashkernel
boot parameter does not load in rhel-guest-image
Presently, RHEL cloud image built by osbuild
misses the crashkernel
kernel parameter. As a result, kdump.service
fails to start.
Workaround: Run kdumpctl
manually to set up the crashkernel
kernel parameter and reboot the system. kdump.service
will start successfully.
Jira:RHEL-63071[1]
The kdump service fails during boot
After the installation of registry.redhat.io/rhel9/rhel-bootc
container image to a physical system, the kdump.service
fails.
Workaround: Ensure the PrivateTmp
service is disabled:
cat /etc/systemd/system/kdump.service.d/override.conf [Service] PrivateTmp=no
# cat /etc/systemd/system/kdump.service.d/override.conf
[Service]
PrivateTmp=no
Then rebuild and restart the kdump service:
touch /etc/kdump.conf systemctl restart kdump
# touch /etc/kdump.conf
# systemctl restart kdump
10.7. File systems and storage
Reverse Mapping B+Tree (rmapbt
) performance impact
By default, the XFS file system enables the rmapbt
feature, which has potential performance regressions in write-heavy workloads with small block sizes. Evaluate performance-sensitive applications carefully, particularly those that heavily rely on writing small data blocks.
Workaround: To disable the rmapbt
feature during file system creation, use the -m rmapbt=0
option. This will revert the default behavior.
Jira:RHEL-33653[1]
Inconsistent NVMe device names after reboot
A new kernel feature that enables asynchronous NVMe namespace scans is introduced in RHEL 10, to accelerate NVMe disk detection. As a consequence of the asynchronous scans, the /dev/nvmeXnY
device files might point to different namespaces after each reboot. This can lead to inconsistent device names. At this time, there is no known workaround for this issue.
Jira:RHEL-85845[1]
10.8. High availability and clusters
ACL roles should not reference location constraints with two rules
In Red Hat Enterprise Linux 10, more than one top-level rule in a location constraint is not supported. When upgrading from RHEL 9 to RHEL 10, verify that any ACL roles you have configured do not reference a location constraint with two rules and are still valid.
10.9. Compilers and development tools
The new version of TBB is incompatible
RHEL 10 includes the Threading Building Blocks (TBB) library version 2021.11.0, which is incompatible with the versions distributed with previous releases of RHEL. You must rebuild applications that use TBB to make them run on RHEL 10.
10.10. Identity Management
IdM in FIPS mode does not support using the NTLMSSP protocol to establish a two-way cross-forest trust
Establishing a two-way cross-forest trust between Active Directory (AD) and Identity Management (IdM) with FIPS mode enabled fails because the New Technology LAN Manager Security Support Provider (NTLMSSP) authentication is not FIPS-compliant. IdM in FIPS mode does not accept the RC4 NTLM hash that the AD domain controller uses when attempting to authenticate.
Jira:RHEL-12154[1]
Installing a RHEL 7 IdM client with a RHEL 10 IdM server in FIPS mode fails due to EMS enforcement
The TLS Extended Master Secret
(EMS) extension (RFC 7627) is now mandatory for TLS 1.2 connections on FIPS-enabled RHEL 10 systems. This is in accordance with FIPS-140-3 requirements. However, the openssl
version available in RHEL 7.9 and lower does not support EMS. In consequence, installing a RHEL 7 Identity Management (IdM) client with a FIPS-enabled IdM server running on RHEL 10 fails.
Workaround: Upgrade the host to RHEL 8 or later before installing an IdM client on it.
Jira:RHELDOCS-19015[1]
DNSSEC not working correctly in RHEL IdM
The DNS Security Extensions (DNSSEC) do not function correctly in Identity Management (IdM) in RHEL 10.0 because of multiple unresolved issues stemming from the replacement of the openssl-pkcs11
OpenSSL engine with the pkcs11-provider
OpenSSL provider.
The changes introduced by OpenSSL have impacted the integrated DNS functionality within RHEL IdM. Specifically, the changes are affecting multiple components in IdM, including ipa
, bind
, bind-dyndb-ldap
, softhsm
, and python-cryptography
, and how these components interact with security modules.
Automatic host keytab renewal via adcli
run by SSSD is failing
In direct SSSD-AD integration, SSSD checks daily if the machine account password is older than the configured age in days and, if needed, tries to renew it. The configured age is set by the ad_maximum_machine_account_password_age
value, with a default of 30
days. A value of 0
disables the renewal attempt.
However, currently there is an issue and the automatic renewal of the machine account password fails. If the password expires, this may result in the host losing access to the AD domain.
Workaround: Renew the password manually or via another means. Do not rely on the SSSD automatic renewal.
Jira:RHELDOCS-19172[1]
dsctl healthcheck
can report a wrong database type
If you created an instance with the Lightning Memory-Mapped Database Manager (LMDB) database type, running the dsctl healthcheck
command can result in one of the following error messages, because Directory Server checks a wrong configuration parameter:
-
DSBLE0005
. Backend configuration attributes mismatch. -
DSBLE0006
. BDB is still used as a backend.
Workaround: Set the NSSLAPD_DB_LIB
environment variable to mdb
before running dsctl healthcheck
.
Jira:RHELDOCS-19014[1]
An error message is displayed during migration from BDB to LMDB
When you run the dsctl dblib bdb2mdb
command to migrate from Berkeley Database (BDB) to Lightning Memory-Mapped Database Manager (LMDB) and you have not enabled the replication, the following error message is displayed in the output:
Error: 97 - 1 - 53 - Server is unwilling to perform - [] - Unauthenticated binds are not allowed
Error: 97 - 1 - 53 - Server is unwilling to perform - [] - Unauthenticated binds are not allowed
Note that you can ignore the error message. The error occurs because Directory Server attempts to find the replication_changelog.db
file that is not mandatory when the replication is disabled. This error does not prevent the migration from BDB to LMDB.
There is currently no workaround for this issue.
Jira:RHELDOCS-19016[1]
ldapmodify
does not delete a single specific value from any attribute in cn=config
Currently, when you try to delete a value from any attribute in cn=config
, the value remains in the attribute and the server may require a restart to fully remove it.
Workaround: Remove the entire attribute, including all its values, by performing a modify operation without specifying any values. Then re-add the values you need. Alternatively, use the following dsconf
command to remove a specific value without a server restart:
dsconf <instance_name> config delete <attribute_name>=<undesired_value>
# dsconf <instance_name> config delete <attribute_name>=<undesired_value>
10.11. SSSD
SSSD retrieves incomplete list of members if the group size exceeds 1500 members
During the integration of SSSD with Active Directory, SSSD retrieves incomplete group member lists when the group size exceeds 1500 members. This issue occurs because Active Directory’s MaxValRange policy, which restricts the number of members retrievable in a single query, is set to 1500 by default.
Workaround: Change the MaxValRange setting in Active Directory to accommodate larger group sizes.
Jira:RHELDOCS-19603[1]
10.12. Desktop
Standard mouse cursor is offset in VMs when using Mutter
When you use a standard mouse within a virtual machine (VM) configuration in the Mutter compositing window manager, you might notice an offset between the physical mouse cursor and the actual pointer within the virtual environment. The actual pointer might not even be visible in the virtual environment.
Workaround: If your scenario requires precise input, use a tablet as an input device in the VM configuration.
10.13. Graphics infrastructures
Standard mouse cursor is offset in VMs when using Mutter
When you use a standard mouse within a virtual machine (VM) configuration in the Mutter compositing window manager, you might notice an offset between the physical mouse cursor and the actual pointer within the virtual environment. The actual pointer might not even be visible in the virtual environment.
Workaround: If your scenario requires precise input, use a tablet as an input device in the VM configuration.
10.14. The web console
VNC console in the RHEL web console does not work correctly on ARM64
Currently, when you import a virtual machine (VM) in the RHEL web console on ARM64 architecture and then you try to interact with it in the VNC console, the console does not react to your input.
Additionally, when you create a VM in the web console on ARM64 architecture, the VNC console does not display the last lines of your input.
Jira:RHEL-31993[1]
10.15. Red Hat Enterprise Linux System Roles
ansible-core
does not install sshpass
as a dependency
The ansible-core
package does not install the sshpass
package as a dependency. Consequently, you can not use Ansible to manage systems over SSH with an SSH password.
Workaround: On the control node, manually install sshpass
after you install ansible-core
. As a result, you can use Ansible in the scenario described above.
Jira:RHEL-86829[1]
10.16. Virtualization
Installing the VirtIO-Win bundle cannot be canceled
Currently, if you start the installation of virtio-win
drivers from the VirtIO-Win installer bundle in a Windows guest operating system, clicking the Cancel
button during the installation does not correctly abort it. The installer wizard interface displays a "Setup Failed" screen, but the drivers are installed and the IP address of the guest is reset.
Jira:RHEL-53962, Jira:RHEL-53965
Secure Execution VMs cannot boot with file-backed memory backing
If you configure a virtual machines (VMs) with enabled Secure Execution to use file-backed memory backing, the VM currently fails to boot, and instead displays a Protected boot has failed
error.
Workaround: Edit the /etc/libvirt/qemu.conf
file and set the memory_backing_dir
line to the following value:
memory_backing_dir = "/dev/shm/"
memory_backing_dir = "/dev/shm/"
Afterwards, the affected VMs can boot as expected.
VMs sending discard I/O requests might pause when discard_granularity
is not configured
The host kernel fails misaligned discard I/O requests and QEMU uses the werror= policy
parameter to respond to such failures. When werror
is set to stop
: werror=stop
, a failed discard request causes the virtual machine (VM) to pause. This is usually undesirable because there is no way to correct this situation and resume the VM again.
Workaround: Ensure that the discard_granularity
parameter on virtio-blk
and virtio-scsi
disks is set and matches the host’s /sys/block/<blkdev>/queue/discard_granularity
value. This makes the VM aware of the alignment constraints and ensures discard requests will be properly aligned, so they do not fail.
Jira:RHEL-87642[1]
The --migrate-disks-detect-zeroes
option might not work for VM migration
Currently, when migrating virtual machines (VMs) on RHEL 10, the --migrate-disks-detect-zeroes
option might not work and the migration might proceed without zeroed block detection on the specified disk. This problem is caused by a bug in QEMU where mirroring jobs had been relying on punching holes, which results in a sparse destination file.
A virtual machine with a large amount of bootable data disks might fail to start
If you attempt to start a virtual machine (VM) with a large amount of bootable data disks, the VM might fail to boot with this error: Something has gone seriously wrong: import_mok_state() failed: Volume Full
Workaround: Decrease the number of bootable data disks and use one system disk. To ensure the system disk is first in the boot order, add boot order=1
to the device definition of the system disk in the XML configuration. For example:
<disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/path/to/disk.qcow2'/> <target dev='vda' bus='virtio'/> <boot order='1'/> </disk>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2'/>
<source file='/path/to/disk.qcow2'/>
<target dev='vda' bus='virtio'/>
<boot order='1'/>
</disk>
Set boot order only for the system disk.
Too many open files in a virtiofs
shared directory can crash the vrtiofsd
process
When accessing a virtiofs
shared directory with a large amount of open files from a virtual machine (VM), the operation might fail with the following error: Too many open files
and the virtiofsd
process might crash.
Workaround: Try any of the following steps:
-
Run
virtiofsd
as root and use the--inode-file-handles=mandatory
command-line option. -
Use the
--cache=never
command-line option. -
Increase the number of file descriptors
virtiofsd
is permitted to use with the--rlimit-nofile
command-line option.
Jira:RHEL-87161[1]
VMs with large memory cannot boot on SEV-SNP host with AMD Genoa CPUs
Currently, virtual machines (VMs) cannot boot on hosts that use a 4th Generation AMD EPYC processor (also known as Genoa) and have the AMD Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) feature enabled. Instead of booting, a kernel panic occurs in the VM.
Jira:RHEL-32892[1]
The virtio balloon driver sometimes does not work on Windows 10 and Windows 11 VMs
Under certain circumstances, the virtio-balloon
driver does not work correctly on virtual machines (VMs) that use a Windows 10 or Windows 11 guest operating system. As a consequence, such VMs might not use their assigned memory efficiently.
Windows 11 VMs with a memory balloon device set might close unexpectedly during reboot
Currently, rebooting virtual machines (VMs) that use a Windows 11 guest operating system and a memory balloon device in some cases fails with a DRIVER POWER STAT FAILURE
blue-screen error.
Jira:RHEL-935[1]
Windows VM with VBS and IOMMU device fails to boot
When you boot a Windows VM with Virtualization Based Security (VBS) enabled and an Input-Output Memory Management Unit (IOMMU) device by using the qemu-kvm
utility, the booting sequence only shows the boot screen, resulting in an incomplete booting process.
Workaround: Ensure the VM domain XML is configured as below:
<features> <ioapic driver='qemu'/> </features> <devices> <iommu model='intel'> <driver intremap='on' eim='off' aw_bits='48'/> <alias name='iommu0'/> </iommu> <memballoon model='virtio'> <alias name='balloon0'/> <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/> <driver iommu='on' ats='on'/> </memballoon> </devices>
<features>
<ioapic driver='qemu'/>
</features>
<devices>
<iommu model='intel'>
<driver intremap='on' eim='off' aw_bits='48'/>
<alias name='iommu0'/>
</iommu>
<memballoon model='virtio'>
<alias name='balloon0'/>
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
<driver iommu='on' ats='on'/>
</memballoon>
</devices>
Otherwise, the Windows VM cannot boot.
Jira:RHEL-45585[1]
Windows VM running on Sapphire Rapids CPU with hypervisor launch type set to auto
might fail to boot when restarted
If you set the hypervisor launch type to auto
in a Windows virtual machine (VM) running on a Sapphire Rapids CPU, the VM might fail to boot when it is restarted. For example, you can set the hypervisor launch type to auto
by using the bcdedit /set hypervisorlaunchtype Auto
command.
Workaround: Do not set the hypervisor launch type to auto
in the Windows VM.
Hot-plugging vCPUs and memory to Windows guests with VBS does not work
Currently, Windows Virtualization-based Security (VBS) is not compatible with hot-plugging CPU and memory resources. As a consequence, attempting to attach memory or vCPUs to a running Windows virtual machine (VM) with VBS enabled only adds the resources to the VM after the guest system is restarted.
Jira:RHEL-66229, Jira:RHELDOCS-19066
10.17. RHEL in cloud environments
RDMA devices currently do not work on vSphere
When using a RHEL 10 instance on the VMware vSphere platform, the vmw_pvrdma
module currently does not install properly. As a consequence, VMware paravirtual remote direct memory access (PVRDMA) devices do not work on the affected instances.
Jira:RHEL-41133[1]
The leapp upgrade fails when upgrading from RHEL 9.6 to RHEL 10.0 for the cloud-init network configuration
If you deploy RHEL 9.6 with the cloud-init
default configuration and with sysconfig
as the default network configuration directory, the sysconfig
configuration files do not support the ifcfg
legacy format for RHEL 10.0. Consequently, the leapp
upgrade fails when upgrading from RHEL 9.6 to RHEL 10.0 for the legacy network configuration files, such as ifcfg-<enp1s0>.
Workaround: Convert the sysconfig
configuration files into the NetworkManager native keyfile
format:
Modify the connection:
nmcli connection modify "System <enp1s0>" connection.id "cloud-init <enp1s0>"
# nmcli connection modify "System <enp1s0>" connection.id "cloud-init <enp1s0>"
Copy to Clipboard Copied! Migrate the connection:
nmcli connection migrate /etc/sysconfig/network-scripts/ifcfg-<enp1s0>
# nmcli connection migrate /etc/sysconfig/network-scripts/ifcfg-<enp1s0>
Copy to Clipboard Copied! Move the connection profile:
sudo mv /etc/NetworkManager/system-connections/"cloud-init <enp1s0>.nmconnection" /etc/NetworkManager/system-connections/cloud-init-<enp1s0>.nmconnection
# sudo mv /etc/NetworkManager/system-connections/"cloud-init <enp1s0>.nmconnection" /etc/NetworkManager/system-connections/cloud-init-<enp1s0>.nmconnection
Copy to Clipboard Copied! Reload the network connection settings:
nmcli conn reload
# nmcli conn reload
Copy to Clipboard Copied!
As a result, the leapp upgrade from RHEL 9.6 to RHEL 10.0 now works with the updated configuration.
Jira:RHEL-82209[1]
Upgrading a RHEL 9.6 guest on VMware ESXi to RHEL 10.0 causes cloud-init
to rewrite the network configuration
After a upgrading a RHEL guest on the VMware ESXi hypervisor from RHEL 9.6 to RHEL 10.0, the cloud-init
tool currently cannot detect the VMware data source and cannot restore its configuration from the cache. As a consequence, cloud-init
reverts to the None
data source, and rewrites the network configuration of the guest.
Workaround: Remove the disable_vmware_customization
flag from the /etc/cloud/cloud.cfg
file before you reboot the guest during the upgrade process. As a result, the upgraded guest will retain its previous network configuration.
Jira:RHEL-82210[1]
Nested VM with KVM virtualization and OVMF fails to boot on Azure or Hyper-V when using AMD EPYC processor
A nested VM with Open Virtual Machine Firmware (OVMF) fails to boot when run on a RHEL VM with KVM virtualization enabled in the Azure cloud or Hyper-V using the AMD EPYC processor. The VM fails to boot up with following log message:
Code=qemu-kvm: ../hw/core/cpu-sysemu.c:76 Aborted (core dumped) .
Code=qemu-kvm: ../hw/core/cpu-sysemu.c:76 Aborted (core dumped) .
Workaround: Try booting without using the AMD EPYC processor.
Jira:RHEL-29919[1]
BIOS or UEFI supported Hyper-V Windows Server 2016 VM fails to boot if a host uses the AMD EPYC CPU processor
With the Hyper-V enabled setting, Hyper-V Windows Server 2016 VM fails to boot on the AMD EPYC CPU host.
Workaround: Check for the following log message:
kvm: Booting SMP Windows KVM VM with !XSAVES && XSAVEC. If it fails to boot try disabling XSAVEC in the VM config.
kvm: Booting SMP Windows KVM VM with !XSAVES && XSAVEC.
If it fails to boot try disabling XSAVEC in the VM config.
And try adding xsavec=off
to -cpu cmdline
to boot Hyper-V Windows Server 2016 VM.
Jira:RHEL-38957[1]
10.18. Containers
Podman and bootc do not share the same registry login process
Podman and bootc
use different registry login processes when pulling images. As a consequence, if you login to an image by using Podman, logging to a registry for bootc
will not work on that image. When you install an image mode for RHEL system, and login to registry.redhat.io by using the following command:
podman login registry.redhat.io <username_password>
# podman login registry.redhat.io <username_password>
And then you attempt to switch to the registry.redhat.io/rhel9/rhel-bootc
image with the following command:
bootc switch registry.redhat.io/rhel9/rhel-bootc:9.4
# bootc switch registry.redhat.io/rhel9/rhel-bootc:9.4
You should be able to see the following message:
Queued for next boot: registry.redhat.io/rhel9/rhel-bootc:9.4
Queued for next boot: registry.redhat.io/rhel9/rhel-bootc:9.4
However, an error appears:
ERROR Switching: Pulling: Creating importer: Failed to invoke skopeo proxy method OpenImage: remote error: unable to retrieve auth token: invalid username/password: unauthorized: Please login to the Red Hat Registry using your Customer Portal credentials. Further instructions can be found here: https://access.redhat.com/RegistryAuthentication
ERROR Switching: Pulling: Creating importer: Failed to invoke skopeo proxy method OpenImage: remote error: unable to retrieve auth token: invalid username/password: unauthorized: Please login to the Red Hat Registry using your Customer Portal credentials. Further instructions can be found here: https://access.redhat.com/RegistryAuthentication
Workaround: Follow the steps Configuring container pull secrets to use authenticated registries with bootc
.
Jira:RHELDOCS-18471[1]
cloud-init
growpart skips with composefs is enabled
When composefs is enabled, if you generate an image from the generic base image, then the rootfs will note grow the filesystem, prompting an error similar to:
2024-04-30 17:27:53,543 - cc_growpart.py[DEBUG]: '/' SKIPPED: stat of 'overlay' failed: [Errno 2] No such file or directory: 'overlay'
2024-04-30 17:27:53,543 - cc_growpart.py[DEBUG]: '/' SKIPPED: stat of 'overlay' failed: [Errno 2] No such file or directory: 'overlay'
Workaround: You can add a custom growpart, by specifying the rootfs
default size in the container, instead of dynamically choosing 100G at instance creation time to be able to write a partitioning config in the container.
FIPS bootc image creation fails on FIPS enabled host
Building a disk image on a host by using Podman with enabled the FIPS mode fails with the exit code 3 because of the update-crypto-policies package:
Enable the FIPS crypto policy crypto-policies-scripts is not installed by default in RHEL-10
# Enable the FIPS crypto policy
# crypto-policies-scripts is not installed by default in RHEL-10
RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS
Workaround: Build the bootc image with FIPS mode disabled.
Insufficient disk space can cause deployment failure
Deploying a bootc container image on a package mode system without enough free disk space can result in installation errors and prevent the system from booting. Ensure adequate disk space is available for the image to install and adjust the provision logical volume before deployment.
Jira:RHELDOCS-19948[1]
RHEL images on Azure marked as LVM require default layout resizing
When using system-reinstall-bootc
or bootc install
on Azure, RHEL images marked as LVM will require resizing the default layout.
Workaround: Use RHEL images labeled as RAW. This does not require resizing the default layout.
Jira:RHELDOCS-19945[1]
10.19. Lightspeed
Configuration file changes are not applied immediately
When making changes in the etc/xdg/command-line-assistant/config.toml
configuration file, it takes around 30 to 60 seconds for the command line assistant daemon to recognize the changes, instead of applying the changes immediately. The command line assistant is also missing the reload
functionality.
Workaround: Follow the steps:
-
Make the changes that you need to the
config.toml
configuration file. - Run the following command:
systemctl restart clad
# systemctl restart clad
Jira:RHELDOCS-19734[1]
10.20. Known issues identified in previous releases
This part describes known issues in Red Hat Enterprise Linux 10.0.
10.20.1. Networking
Failure to update the session key causes the connection to break
Kernel Transport Layer Security (kTLS) protocol does not support updating the session key, which is used by the symmetric cipher. Consequently, the user cannot update the key, which causes a connection break.
Workaround: Disable kTLS. As a result, with the workaround, it is possible to successfully update the session key.
Jira:RHELPLAN-99859[1]
kTLS does not support offloading of TLS 1.3 to NICs
Kernel Transport Layer Security (kTLS) does not support offloading of TLS 1.3 to NICs. Consequently, software encryption is used with TLS 1.3 even when the NICs support TLS offload.
Workaround: Disable TLS 1.3 if offload is required. As a result, you can offload only TLS 1.2. When TLS 1.3 is in use, there is lower performance, since TLS 1.3 cannot be offloaded.
Jira:RHELPLAN-96004[1]
Chapter 11. Fixed issues
This version provides the following fixed issues and other problems that have a significant impact.
11.1. Installer and image creation
Improved installer stability during virtual network devices configuration
Previously, the installer could crash when creating a VLAN network device over an existing virtual network device (for example, Team or Bond) in the GUI. This occurred when the underlying device’s state changed during the configuration update to the user interface for the new device state.
With this update, the process of refreshing the state of networking in GUI optimized to handle changes in the virtual device state. As a result, the installer no longer crashes due to changes regarding virtual network devices configured in GUI.
11.2. Security
IPsec ondemand
connections no longer fail to establish
Previously, when an IPsec connection with the ondemand
option was configured by using the TCP protocol, the connection failed to establish. With this update, the new Libreswan package makes sure that the initial IKE negotiation completes over TCP. As a result, Libreswan successfully establishes the connection even in TCP mode of IKE negotiation.
Jira:RHEL-51880[1]
NSS now enforce EMS in FIPS mode
The Network Security Services (NSS) libraries now contain the TLS-REQUIRE-EMS
keyword to require the Extended Master Secret (EMS) extension (RFC 7627) for all TLS 1.2 connections as mandated by the FIPS 140-3 standard. NSS use the new keyword when the system-wide cryptographic policies are set to FIPS
.
If your scenario requires interoperating with legacy systems without support for EMS or TLS 1.3, you can apply the NO-ENFORCE-EMS
system-wide cryptographic subpolicy. However, this change violates the FIPS-140-3 requirements.
shlibsign
now works in FIPS mode
Before this update, the shlibsign
program did not work in FIPS mode. Consequently, when you rebuilt an NSS library in FIPS mode, you had to leave FIPS mode to sign the library. The program has been fixed, and you can now use shlibsign
in FIPS mode.
Jira:RHEL-61291[1]
OpenSSL cipher suites no longer enable cipher suites with disabled hashes or MACs
Previously, applying custom cryptographic policies could leave certain TLS 1.3 cipher suites enabled even if their hashes or MACs were disabled, because the OpenSSL TLS 1.3-specific Ciphersuites
option values were controlled only by the ciphers
option of the cryptographic policy. With this update, crypto-policies
takes more algorithms into account when deciding whether to enable a cipher suite. As a result, OpenSSL on systems with custom cryptographic policies might refuse to negotiate some of the previously enabled TLS 1.3 cipher suites in better accordance with the system configuration.
update-ca-trust extract
no longer fails to extract certificates with long names
When extracting certificates from the trust store, the trust
tool internally derives the file name from the certificates’ object label. For long enough labels, the resulting path might previously have exceeded the system’s maximum file name length. As a consequence, the trust
tool failed to create a file with a name that exceeded the maximum file name length of a system. With this update, the derived name is always truncated to within 255 characters. As a result, file creation does not fail when the object label of a certificate is too long.
Jira:RHEL-64915[1]
Binary tests for libcap
are waived
The annocheck
tool discovered binary packages in the libcap
library function that were built without the required flags for RHEL 10 architectures. We examined the flags for potential problems and did not find any. After careful investigation, we have waived the results for libcap
. As a result, all tests for libcap
passed.
Jira:RHEL-33498[1]
11.3. Shells and command-line tools
ReaR now interprets square brackets enclosing IPv6 addresses in URLs as expected
Previously, square brackets in OUTPUT_URL
and BACKUP_URL
were not interpreted correctly. Specifying an IPv6 address instead of a host name requires enclosing the address in square brackets, for example, [::1] for localhost. Since the brackets were not interpreted correctly, using an IPv6 address in a sshfs://
or nfs://
URL was not possible.
As a consequence, if the user used a sshfs://
or nfs://
scheme in the BACKUP_URL
or OUTPUT_URL
with an IPv6 address enclosed in square brackets, ReaR aborted prematurely with an error message, for example:
ERROR: Invalid scheme '' in BACKUP_URL
ERROR: Invalid scheme '' in BACKUP_URL
With this update, ReaR is now fixed to not interpret square brackets as shell metacharacters when parsing sshfs://
and nfs://
URLs. Now, you can use IPv6 addresses enclosed in brackets in BACKUP_URL
and OUTPUT_URL
that use the sshfs://
or nfs://
scheme . For example:
OUTPUT_URL=nfs://[2001:db8:ca2:6::101]/root/REAR
OUTPUT_URL=nfs://[2001:db8:ca2:6::101]/root/REAR
Before this fix was implemented, it was possible to work around the bug by using quoting and backslash characters, for example:
OUTPUT_URL="nfs://\[2001:db8:ca2:6::101\]/root/REAR"
OUTPUT_URL="nfs://\[2001:db8:ca2:6::101\]/root/REAR"
Note: If you have been using the workaround, remove the backslash characters after applying the update.
Jira:RHEL-46613[1]
11.4. Infrastructure services
cups-filters
project is now split into several projects
The cups-filters
project is split into several projects . The notable packages are mentioned below :
-
libcupsfilters
: replacement for cups-filters-libs RPM. -
libppd
PPD library for retrofitting PPD support is added as a new component. -
cups-browsed
: the daemon which was previously shipped in cups-filters. -
cups-filters
: filters needed for various printing. -
cups-filters-driverless
: ships driver less utilities, split from cups-filters to prevent additional dependencies for customers, who do not want to use the driver less utilities.
The customers who have disabled weak dependencies will not receive the cups-browsed
and cups-filters-driverless
packages, as they are weak dependencies of CUPS in RHEL 10. The cups-browsed
package is part of the Server comps data and is installed by default in Server variants.
Jira:RHELDOCS-17679[1]
11.5. Networking
NetworkManager can mitigate the impact of CVE-2024-3661 (TunnelVision) in VPN connection profiles
VPN connections rely on routes to redirect traffic through a tunnel. However, if a DHCP server uses the classless static route option (121) to add routes to a client’s routing table, and the routes propagated by the DHCP server overlap with the VPN, traffic can be transmitted through the physical interface instead of the VPN. CVE-2024-3661 describes this vulnerability, which is also know as TunnelVision. As a consequence, an attacker can access traffic that the user expects to be protected by the VPN.
On RHEL, this problem affects LibreSwan IPSec and WireGuard VPN connections. Only LibreSwan IPSec connections with profiles in which both the ipsec-interface
and vt-interface
properties are undefined or set to no
are not affected.
The CVE-2024-3661 document describes steps to mitigate the impact of TunnelVision by configuring VPN connection profiles to place the VPN routes in a dedicated routing table with a high priority. The steps work for both LibreSwan IPSec and WireGuard connections.
Jira:RHEL-64719[1]
RHEL 10 provides libnftnl
version 1.2.8
The libnftnl
library version 1.2.8 provides a few bug fixes. Notable changes include:
-
Fixes incorrect validation of the
dynset
Netlink attribute from the kernel. - No longer appends a newline when printing a rule.
11.6. Boot loader
The GRUB2 net_del_dns
command deletes the DNS server correctly
Previously, if you attempted to delete the DNS server by using the net_del_dns
command, it added the DNS server back erroneously because of incorrect implementation, and returned an error. With this fix, the add
command was replaced by the remove
command in the net_del_dns
implementation. As a result, you can delete the DNS server by using the net_del_dns
command.
11.7. File systems and storage
The Kickstart file now correctly sets the required device size for installation when using LVM partitioning with LUKS
Before this update, when you specified the --size=1 --grow --encrypted
option in the Kickstart file for a new device, the installer failed to correctly expand the encrypted device to a valid size. Consequently, the automated installation stopped with an error message, for example:
"Kickstart insufficient" "('device cannot be smaller than 16 MiB', 'luks5'
"Kickstart insufficient" "('device cannot be smaller than 16 MiB', 'luks5'
You would then have to proceed with manual installation without the Kickstart file.
With this update, the installation starts successfully with the device specified in the Kickstart file with --size=1 --grow --encrypted
. As a result, the installation proceeds without errors.
multipathd
no longer crashes because of errors encountered by the ontap prioritizer
Before this update, multipathd
crashed when it was configured to use the ontap prioritizer on an unsupported path, because the prioritizer only works with NetApp storage arrays. This failure occurred due to a bug in the prioritizer’s error logging code, which caused it to overflow the error message buffer. With this update, the error logging code has been fixed, and multipathd
no longer crashes because of errors encountered by the ontap prioritizer.
Jira:RHEL-49747[1]
Native NVMe multipathing no longer causes a memory leak when enable_foreign
is set to monitor natively multipathed NVMe devices
Before this update, enabling native NVMe multipathing caused a memory leak if the enable_foreign
configuration parameter was set to monitor natively multipathed NVMe devices. With this update, the memory leak was fixed in multipathd
monitoring code. As a result, multipathd
can now monitor natively multipathed NVMe devices without increasing memory usage.
Jira:RHEL-73410[1]
RHEL installer now discovers and uses iSCSI devices as boot devices on aarch64
Previously, the absence of the iscsi_ibft
kernel module in RHEL installers running on aarch64
prevented the automatic discovery of iSCSI devices defined in firmware. As a result, these devices were not automatically visible nor selectable as boot devices in the installer during manual addition GUI.
This issue has been resolved by including the iscsi_ibft
kernel module in newer aarch64
builds of RHEL. As a result, the iSCSI devices are now automatically detected and available as boot options during installation.
Jira:RHEL-75491[1]
fstrim
enabled by default on LUKS2 root in ostree-based new installations done by Anaconda
Previously, installing ostree-based systems, such as Image Mode, by using ostreesetup
or ostreecontainer
Kickstart commands with LUKS2 encryption enabled on the /
(root) mount point resulted in systems where fstrim
was not enabled. This could cause issues such as unresponsive systems or broken file chooser dialogs. With this fix, fstrim
(discards) is now enabled by default in the LUKS2 metadata on newly installed systems.
To fix this issue in the existing installations, run the following command: …. cryptsetup --allow-discards --persistent refresh <luks device>
…. <luks device>
is the path to the root LUKS2 device.
11.8. High availability and clusters
pcs
validation of SBD options
Previously, when you enabled SBD with the pcs stonith sbd enable
command and specified values for SBD options that are not valid, it resulted in SBD misconfiguration. The pcs
command-line interface has been updated to validate the values for SBD options. When the values are not valid, pcs
reports the error and does not create or update an SBD configuration.
Jira:RHEL-38484[1]
Ability to remove Booth configuration from a Booth arbitrator node
Previously, running the pcs booth destroy
command to remove Booth configuration from a Booth arbitrator node yielded an error. This happened because the command did not remove Booth configuration from nodes that are not part of the cluster. It is now possible to remove Booth configuration from Booth arbitrators.
Jira:RHEL-38486[1]
pcsd
processes now consistently stop correctly and promptly
Previously, the creation method for pcsd
processes sometimes caused a deadlock during process termination. The processes were then terminated only after a systemd
timeout. This fix changes the process creation method and there is no longer a deadlock when the processes are stopped. As a result, pcsd
consistently stops correctly within a short time.
Jira:RHEL-38478[1]
pcs
no longer validates fencing topology with fencing levels greater than 9
The Pacemaker cluster resource manager ignores fencing topology levels greater than 9. Configuring levels greater than 9 may lead to failed fencing. With this update, you can configure fencing levels with values of only 1 to 9 in the pcs
command-line interface and fencing topology works correctly.
Jira:RHEL-38479[1]
The syntax for specifying a scorevalue is now consistent across all pcs constraint
commands
Previously, some commands for creating constraints required you to specify a score value as score=value
, whereas others expected just value
without score=
. With this update, all constraint commands accept a score value in the form score=value
, with the exception of pcs constraint location prefers
and pcs constraint location avoids
, which expect node=score
where score
is the score value.
Jira:RHEL-34792[1]
The CIB manager no longer increases in size indefinitely with each request from an asynchronous client
Previously, when the CIB manager received a request from an asynchronous client, it leaked a small amount of memory. This caused the CIB manager process gradually to grow in size. With this fix, the relevant memory is freed for asynchronous clients and the CIB manager process does not grow in size indefinitely.
Resource constraints with expired rules no longer display
Before this update, the pcs constraint location config resources
command displayed resource constraints with expired rules in the output. With this update, the command no longer displays constraints with expired rules if you do not specify the --all
option.
Cluster status of a disaster recovery site now displays correctly
Before this update, when you configured a disaster recovery site and ran the pcs dr status
command to display the status of the local and remote cluster sites, the command displayed an error instead of the cluster status. With this update, the cluster status of the local and remote sites displays correctly when you execute this command.
Status of a cloned resource running with only one instance now displays properly
Before this update, when you queried the status of the instances of a cluster resource clone with only one running instance, the pcs status query
command displayed an error message. With this update, the command reports the resource status properly.
11.9. Compilers and development tools
Go applications no longer panic if OpenSSL is not installed
Previously, if the OpenSSL library was not installed, applications created with Go panicked even if the Federal Information Processing Standard (FIPS) mode was disabled. This update solves this problem. As a result, you can now run applications created with Go if OpenSSL is not installed.
Jira:RHEL-52486[1]
Go now uses ld.bfd
as the default linker on the 64-bit ARM platform
In previous RHEL versions, Go used the ld.gold
linker only on 64-bit ARM platforms and ld.bfd
on other platforms. Because ld.gold
is deprecated in the binutils
project, Go now also uses ld.bfd
on 64-bit ARM platforms.
11.10. Identity Management
The ipa idrange-add
command now warns that Directory Server must be restarted on all IdM servers
Previously, the ipa idrange-add
command did not warn the administrator that they must restart the Directory Server (DS) service on all IdM servers after creating a new range. As a consequence, the administrator sometimes created a new user or group with a UID or GID belonging to the new range without restarting the DS service. The addition resulted in the new user or group not having an SID assigned. With this update, a warning that DS needs to be restarted on all IdM servers is added to the command output.
Jira:RHELDOCS-18201[1]
The ipa-replica-manage
command no longer resets the nsslapd-ignore-time-skew
setting during forced replication
Previously, the ipa-replica-manage
force-sync
command reset the nsslapd-ignore-time-skew
setting to off
, regardless of the configured value. With this update, the nsslapd-ignore-time-skew
setting is no longer overwritten during forced replication.
certmonger
now correctly renews KDC certificates on hidden replicas
Previously, when the certificate was about to expire, certmonger
failed to renew the KDC certificate on hidden replicas. This happened because the renewal process only considered non-hidden replicas as active KDCs. With this update, the hidden replicas are treated as active KDCs, and certmonger
renews the KDC certificate successfully on these servers.
Jira:RHEL-46607[1]
Bypassing two-factor authentication using an expired token is no longer possible
Previously, it was possible to bypass two-factor authentication by creating an OTP token with a specific end-validity period.
In cases where two-factor authentication is enforced, a user without an OTP token could use their password to log in once and configure an OTP token. Subsequently, they would be required to use both their password and the OTP token for authentication. However, if a user created an OTP token with an expired end-validity date, IdM would incorrectly fall back to password-only authentication, effectively bypassing two-factor authentication. This was due to IdM not differentiating between non-existent and expired OTP tokens.
With this update, IdM now correctly differentiates between these scenarios. Consequently, two-factor authentication is now correctly enforced, preventing this bypass.
Jira:RHEL-63325[1]
The Account Policy plug-in now uses a proper flag for an update in a replication topology
Before this update, the Account Policy plugin did not use the proper flag for an update. As a result, in a replication topology, the Account Policy plugin updated the login history, but this update failed on a consumer server logging the following error message:
{{ERR - acct_update_login_history - Modify error 10 on entry }}
{{ERR - acct_update_login_history - Modify error 10 on entry
}}
With this update, the internal update succeeds and no errors are logged.
TLS 1.3 can now be used to connect to an LDAP server running in FIPS mode
Before this update, when you tried to explicitly set TLS 1.3 when connecting to an LDAP server in FIPS mode, the used TLS version still remained 1.2. As a result, an attempt to connect to the LDAP server by using TLS 1.3 failed. With this update, the upper limit of the TLS version in FIPS mode was changed to 1.3, and the attempt to connect to an LDAP server with TLS 1.3 no longer fails.
Jira:RHEL-79498[1]
A race condition with paged result searches no longer closes the connection with a T3
error code
Before this update, Directory Server did not use the proper thread protection when checking the connection’s paged result data for a timeout event. As a consequence, the paged result timeout value changed unexpectedly and triggered a false timeout when a new operation arrived. This caused a time out error and the connection was closed with the following T3
error code:
The server closed the connection because the specified time limit for a paged result search has been exceeded.
With this update, the proper thread protection is used, and paged result searches no longer close the connection with a T3
error code.
Jira:RHEL-76020[1]
ldapsearch
now respects the NETWORK_TIMEOUT
setting as expected
Before this update, an ldapsearch
command ignored the timeout when the server was unreachable and, as a consequence, the search hung indefinitely instead of timing out. With this update, the logic error in TLS handling was fixed by adjusting connection retries and socket options.
As a consequence, the ldapsearch
command no longer ignores the NETWORK_TIMEOUT setting and returns the following error when the timeout is reached:
`ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)`.
`ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)`.
OpenLDAP library no longer fails when trying to free resources
Before this update, the OpenLDAP library tried to release memory by using the SSL_CTX_free()
function in its destructor when an application had already cleaned up these resources by invoking the OPENSSL_cleanup()
function, either directly or via the atexit()
function. As a consequence, users experienced failures or undefined behavior when the invalid SSL_CTX_free()
call tried to release already-cleaned-up SSL context resources.
With this update, a safe cleanup function has been added to skip SSL context cleanup in the OpenLDAP’s destructor. As a result, the SSL context now leaks if not explicitly freed, ensuring a stable application shutdown.
Jira:RHEL-68424[1]
Reindexing no longer fails when an entry RDN has the same value as the suffix DN
Before this update, if an entry’s relative distinguished name (RDN) had the same value as the suffix distinguished name (DN) in the directory, then the entryrdn
index got broken. As a result, Directory Server could perform slow search requests, get invalid results, and write alarming messages in the error log.
With this update, reindexing works as expected.
Jira:RHEL-69819[1]
11.11. SSSD
sssd-polkit-rules
package content moved to sssd-common
Previously, if you needed to enable smart card support when the system security services daemon (SSSD) did not run as root
, you had to install the sssd-polkit-rules
package. The package provided polkit
integration with SSSD. To resolve this issue, the sssd-common
package now includes the content of the sssd-polkit-rules
package and installation of a separate package is no longer required.
11.12. Red Hat Enterprise Linux System Roles
No property conflicts between the NetworkManager
service and the NetworkManager
plugin
Before this update, the network
RHEL system role did not request user consent to restart the NetworkManager
service when updates were available to networking packages, particularly, due to wireless interface changes. Consequently, this led to potential conflicts between the NetworkManager
service and the NetworkManager
plugin. Alternatively, the NetworkManager
plugin was failing to run correctly. The problem has been fixed by making the network
RHEL system role ask user for their consent to restart the NetworkManager
service. As a result, there are no property conflicts between the NetworkManager
service and the NetworkManager
plugin in the described scenario.
Jira:RHEL-34887[1]
Implementation of multiple sets of key-value pairs of node attributes is now consistent with other cluster configuration components
The ha_cluster
RHEL system role supports only one set of key-value pairs for each configuration item. Previously, when you configured multiple sets of node attributes, the sets were merged into a single set. With this update, the role uses only the first set you define and ignores the other sets. This behavior is now consistent with how the role implements multiple sets of key-value pairs for other configuration components that use a key-value pair structure.
Jira:RHEL-34886[1]
The postgresql
RHEL system role no longer fails to set the paths to a TLS certificate and private key
The postgresql_cert_name
variable of the postgresql
RHEL system role defines the base path to the TLS certificate and private key without suffix on the managed node. Before this update, the role did not define internal variables for the certificate and private key. As a consequence, if you set postgresql_cert_name
, the Ansible task failed with the following error message:
The task includes an option with an undefined variable. The error was: '__pg_server_crt' is undefined. '__pg_server_crt' is undefined
The task includes an option with an undefined variable. The error was: '__pg_server_crt' is undefined. '__pg_server_crt' is undefined
With this update, the role correctly defines these internal variables, and the task sets the paths to the certificate and private key in the PostgreSQL configuration files.
Jira:RHEL-67418[1]
The bootloader
RHEL system role generates the missing /etc/default/grub
configuration file if necessary
Before this update, the bootloader
RHEL system role expected the /etc/default/grub
configuration file to be present. In some cases, for example on OSTtree systems, /etc/default/grub
can be missing. As a consequence, the role failed unexpectedly. With this update, the role generates the missing file with default parameters if necessary.
Jira:RHEL-34881[1]
The podman
RHEL system role can set the ownership of the host directory again
Before this update, the podman
RHEL system role was using the become
keyword with the user when setting the ownership of the host directory. As a consequence, the role could not properly set the ownership. With this update, the podman
RHEL system role does not use become
with the ordinary user. Instead, it uses the root
user. As a result, podman
can set the ownership of the host directory.
As a complement to this bugfix, the following role variables have been added to the podman
RHEL system role:
-
podman_subuid_info
(dictionary): Exposes information used by the role from the/etc/subuid
file. This information is needed to properly set the owner information for host directories. -
podman_subgid_info
(dictionary): Exposes information used by the role from the/etc/subgid
file. This information is needed to properly set the group information for host directories.
For more details about the newly added variables, see the resources in the /usr/share/doc/rhel-system-roles/podman/
directory.
Jira:RHEL-34888[1]
The linger feature can be canceled for the correct users
When processing the instruction list of configuration items from kube files or Quadlet files, the podman
RHEL system role was incorrectly using the user ID associated with the entire list. It did not use the user ID associated with the list item to compile the linger file name. Consequently, the linger file was not created and therefore the podman
RHEL system role could not cancel the linger feature for the actual user if necessary. With this update, podman
uses the correct username to construct the linger file name. As a result, the linger feature can be canceled for the correct users.
Jira:RHEL-34889[1]
The storage
RHEL system role is idempotent again
The storage
RHEL system role in some cases incorrectly calculated sizes of existing devices. Consequently, running the same playbook again without changes caused the role to attempt resizing the device that already had the correct size, instead of passing without errors. With this update, the size calculation was fixed. As a result, the role now correctly identifies that the device already has the size specified by the playbook and does not try to resize it.
Jira:RHEL-34895[1]
Running the storage
RHEL system role on a system with a pre-existing Stratis pool works as expected
Before this update, the storage
RHEL system role could not process the existing devices and device formats. This caused the role to fail on systems with a pre-existing Stratis pool, when checking if Stratis format conformed to the configuration specified by the playbook. Consequently, the playbook failed with an error, however the Stratis pool itself was not damaged or changed. This update makes the storage
RHEL system role work correctly with Stratis devices and other formats without labelling support. As a result, running a playbook on a system with a pre-existing Stratis pool no longer fails.
Jira:RHEL-34907[1]
You cannot set the name
parameter for the imuxsock
input type
Before this update, the logging
RHEL system role incorrectly set a name parameter for the imuxsock
input type. As a consequence, this input type did not support the name
parameter and the rsyslog
utility on the managed node printed this error …parameter 'name' not known — typo in config file?…
. This update fixes the logging
RHEL system role to ensure that the name
parameter is not associated with the imuxsock
input type.
GRUB2 on RHEL 10 and RHEL 9 UEFI managed nodes correctly prompts for a password
Before this update, the bootloader
RHEL system role incorrectly placed the password information in the /boot/efi/EFI/redhat/user.cfg
file on managed nodes that ran RHEL 10 and RHEL 9 with UEFI Secure Boot feature. The correct location was the /boot/grub2/user.cfg
file. Consequently, when you rebooted the managed node to modify any boot loader entry, GRUB2 did not prompt you for a password. This update fixes the problem by setting the path for user.cfg
to /boot/grub2/
in the source code. When you reboot the OS on a UEFI Secure Boot managed node to modify any boot loader entry, GRUB2 prompts you to input your password.
Jira:RHEL-40759[1]
Removing Quadlet-defined networks using podman
works irrespective of a custom NetworkName
directive
When removing networks, the podman
RHEL system role was using the "systemd- + name of the Quadlet file" syntax for the network name. Consequently, if the Quadlet file had a different NetworkName
directive in it, the removal would fail. With this update, the podman
source code has been updated to use "the Quadlet file name + the NetworkName
directive from that file" as a name of the network to remove. As a result, removal of networks defined by Quadlet files using the podman
RHEL system role works both with and without a custom NetworkName
directive in the Quadlet file.
The podman
RHEL system role creates new secrets if necessary
The podman
RHEL system role incorrectly did not check whether a secret with the same name already existed if you used the skip_existing: true
option of the podman_secrets
role variable. Consequently, the role did not create any new secret if using that option. This update fixes the podman
RHEL system role to check for existing secrets if you use skip_existing: true
. As a result, the role properly creates new secrets if they do not exist. Conversely, it does not create a secret of the same name if you use skip_existing: true
.
Jira:RHEL-40795[1]
The network units in the Quadlet unit files are now properly cleaned up
The podman
RHEL system role was not correctly managing the network units defined under the [Network]
section in the Quadlet unit files. Consequently, the network units were not stopped and disabled and subsequent runs would fail due to those units not being cleaned up properly. With this update, podman
manages the [Network]
units, including stopping and removing. As a result, the [Network]
units in the Quadlet unit files are properly cleaned up.
Jira:RHEL-50104[1]
The podman
RHEL system role now correctly searches for subgid
values
Subordinate group IDs (subgid
) is a range of group ID values assigned to non-root users. By using these values, you can run processes with different group IDs inside a container compared to the host system. Before this update, the podman
RHEL system role was incorrectly searching in the subgid
values using the group name instead of using the user name. Consequently, the difference between the user name and the group name made podman
fail to look up the subgid
values. This update fixes podman
to correctly search for subgid
values and the problem no longer appears in this scenario.
Jira:RHEL-57100[1]
The certificate
RHEL system role correctly reports an error when an issued certificate is missing the private key
When the private key of a certificate was removed, the certmonger
utility on a managed node entered an infinite loop. Consequently, the certificate
RHEL system role on the control node became unresponsive when re-issuing a certificate that had the private key deleted. With this update, the certificate
RHEL system role stops processing and provides an error message with instructions for remedy. As a result, certificate
no longer becomes unresponsive in the described scenario.
Jira:RHEL-70536[1]
The firewall
RHEL system role reports changed: True
when there were changes applied
During playbook processing, the firewall_lib.py
module from the firewall
RHEL system role was replacing the changed
message with False
when using the interface
variable in the playbook and a pre-existing networking interface on the managed node. As a consequence, firewall
reported the changed: False
message even when there had been changes done, and the contents from the forward_port
variable were not saved as permanent. With this update, the firewall
RHEL system role ensures the changed
value is not reset to False
. As a result, the role reports changed: True
when there are changes, and forward_port
contents are saved as persistent.
Jira:RHEL-67412[1]
The podman
RHEL system role no longer fails to process secrets when using the run_as_user
variable
Before this update, the podman
RHEL system role failed to process secrets that were specified for a particular user using the run_as_user
variable due to missing user information. This caused errors when attempting to process secrets which have run_as_user
set. The issue has been fixed, and the podman
RHEL system role correctly handles secrets which are specified for a particular user using the run_as_user
variable.
Jira:RHEL-73443[1]
The cockpit
RHEL system role installs all cockpit
-related packages that match a wildcard pattern
Before this update, the dnf
module used through the cockpit
RHEL system role did not install all cockpit
-related packages. As a consequence, some requested packages were not installed. With this update, the source code of the cockpit
RHEL system role was changed to use the dnf
module directly with an asterisk wildcard package name and a list of packages to exclude. As a result, the role correctly installs all requested packages that match the wildcard pattern.
Jira:RHEL-45944[1]
The sshd
RHEL system role can configure the second sshd
service correctly
Running the sshd
RHEL system role to configure the second sshd
service on your managed nodes caused an error if you did not specify the sshd_config_file
role variable. Consequently, your playbook would fail and the sshd
service would not be configured correctly. To fix the problem, deriving of the main configuration file has been improved. Also, the documentation resources in the /usr/share/doc/rhel-system-roles/sshd/
directory have been made clearer to avoid this problem. As a result, configuring the second sshd
service as described in the above scenario works as expected.
Jira:RHEL-34879[1]
The network
RHEL system role prioritizes permanent MAC address matching
When all of the following conditions were met:
- A network connection specified both an interface name and a media access control (MAC) address for configuring a parent and a virtual local area network (VLAN) connection.
- The physical interface had the same permanent and current MAC address.
- The networking configuration was applied multiple times.
The network
RHEL system role compared the user-specified MAC address against either the permanent MAC or the current MAC address from the sysfs
virtual filesystem. The role then treated a match with the current MAC as valid even if the interface name was different from what the user specified. As a consequence, the "no such interface exists" error occurred. With this update, the link_info_find()
method prioritizes matching links by permanent MAC address when it is valid and available. If the permanent MAC is unavailable (None or "00:00:00:00:00:00"), the method falls back to matching the current MAC address. As a result, this change improves the robustness of MAC address matching by ensuring that permanent addresses are prioritized while maintaining a reliable fallback mechanism for interfaces with no permanent address.
Jira:RHEL-73442[1]
The new sshd_allow_restart
variable enables the sshd
service to be restarted when needed
Before this update, the sshd
RHEL system role was not restarting the sshd
service on a managed node when required. As a consequence, some changes related to configuration files from the`/etc/sysconfig/` directory and environment files were not applied. To fix the problem, the sshd_allow_restart
(boolean, defaults to true
) variable has been introduced to restart the sshd
service on the managed node when necessary. As a result, the sshd
RHEL system role now correctly applies all changes and ensures the sshd
service actually uses those changes.
Jira:RHEL-73439[1]
The ansible-doc
command provides the documentation again for the redhat.rhel_system_roles
collection
Before this update, the vpn
RHEL system role did not include documentation for the internal Ansible filter vpn_ipaddr
. Consequently, using the ansible-doc
command to list documentation for the redhat.rhel_system_roles
collection would trigger an error. With this update the vpn
RHEL system role includes the correct documentation in the correct format for the vpn_ipaddr
filter. As a result, ansible-doc
does not trigger any error and provides the correct documentation.
Jira:RHEL-67421[1]
The storage
RHEL system role correctly resizes logical volumes
The physical volume was not resized to its maximum size when using the grow_to_fill
feature in the storage
RHEL system role to automatically resize LVM physical volumes after resizing the underlying virtual disks. Consequently, not all of the storage free space was available when resizing existing or creating new additional logical volumes; and the storage
RHEL system role failed. This update fixes the problem in the source code to ensure the role always resizes the physical volumes to their maximum size when using grow_to_fill
.
Jira:RHEL-76504[1]
The storage
RHEL system role now runs as expected on RHEL 10 managed nodes with VDO
Before this update, the blivet
module required the kmod-kvdo
package on RHEL 10 managed nodes using Virtual Data Optimizer (VDO). However, kmod-kvdo
failed to install, and as a consequence caused even the storage
RHEL system role to fail. The fix to this problem ensures that kmod-kvdo
is not a required package for managed nodes with RHEL 10. As a result, storage
no longer fails when managed nodes with RHEL 10 use VDO.
Jira:RHEL-81963[1]
11.13. Virtualization
vGPU live migration no longer reports excessive amount of dirty pages
Previously, when performing virtual machine (VM) live migration with an attached NVIDIA vGPU, an excessive amount of dirty pages could have been incorrectly reported during the migration. This problem could have increased the required VM downtime during the migration and the migration could have potentially failed.
With this update, the underlying problem has been fixed and the correct amount of dirty pages is reported during the migration, which can reduce the required VM downtime during vGPU live migration in some cases.
Jira:RHEL-64308[1]
QEMU no longer prevents using SEV-SNP
Previously, when attempting to start a virtual machine (VM) with AMD SEV-SNP enabled, QEMU checked the incorrect capability of KVM, and the guest failed to start. As a consequence, running VMs with AMD SEV-SNP configured was not possible with RHEL10. This problem has been fixed, and running VMs with SEV-SNP works as expected now.
Jira:RHEL-58928[1]
Network boot for VMs now works correctly without an RNG device
Previously, when a virtual machine (VM) did not have an RNG device configured and its CPU model did not support the RDRAND feature, it was not possible to boot the VM from the network. With this update, the problem has been fixed, and VMs that do not support RDRAND can boot from the network even without an RNG device configured.
Note, however, that adding an RNG device is highly encouraged for VMs that use a CPU model that does not support RDRAND, in order to increase security when booting from the network.
RHEL 10 guests no longer crash on restart in GCP and Alibaba
When using a RHEL 10.0 instance on Google Cloud Platform or the Alibaba Cloud, restarting the instance previously caused a kernel panic in the guest operating system if the virtio-net
driver was in use. This issue has been fixed and RHEL 10 guests no longer crash in the described scenario.
Jira:RHEL-56981[1]
11.14. RHEL in cloud environments
The mana
driver with Azure Accelerated Networking assigns a correct IP address to a VM
Previously, when launching a Red Hat Enterprise Linux VM on the Azure platform with Accelerated Networking enabled, the NetworkManager-wait-online.service
service might failed to start on boot. Consequently, the VM might failed to acquire IP address from a DHCP server when using Azure Accelerated Networking with the mana
driver. With this fix, you need to install the latest version of the WALinuxAgent-udev
package. As a result, Azure VMs with Accelerated Networking along with the mana
driver will be assigned with a correct IP address at boot time.
Jira:RHEL-68796[1]
11.15. Supportability
The sos
now obfuscates proxy passwords in several places
Previously, the sos
utility did not obfuscate passwords from proxy links. For example HTTP_PROXY
and HTTPS_PROXY
in the /etc/environment
file. As a consequence, the sos
utility could collect sosreports with customer proxy passwords unless cleaned up before submitting. This may pose a security concern. Several of those places were discovered and fixed to obfuscate the passwords.
Red Hat continually improves the sos utility to enhance obfuscation capabilities; however, the complete removal of sensitive information is not guaranteed. Users are responsible for reviewing and manually cleaning up any confidential data before sharing it with Red Hat.
Jira:RHEL-67712[1]
The sos clean
on an existing archive no longer fails
Previously, an existing archive could not be cleaned by running sos clean
due to a regression in the sos
code that incorrectly detected the root directory of a tarball and prevented it from cleaning data. As a consequence, sos clean
running on an existing sosreport tarball does not clean anything within the tarball. This update adds an implementation of a proper detection of the root directory in the reordered tarball content. As a result, sos clean
performs sensitive data obfuscation on an existing sosreport tarball correctly.
The sos stops collecting user’s .ssh
configuration
Previously, the sos
utility collected the .ssh
configuration by default from a user. As a consequence, this action caused a broken system for users that are mounted by using automount utility. With this update, the sos
utility no longer collects the .ssh
configuration.
11.16. Containers
Netavark no longer fails resolving DNS TCP queries
Previously, when you ran a container in a Podman network, some domain names would not resolve even though they worked on the host system or in a container not using the Podman network. With this update, Netavark supports TCP DNS queries and the problem is fixed.
Chapter 12. Available BPF features
This chapter provides the complete list of Berkeley Packet Filter (BPF) features available in the kernel of this minor version of Red Hat Enterprise Linux 10. The tables include the lists of:
This chapter contains automatically generated output of the bpftool feature
command.
Option | Value |
---|---|
unprivileged_bpf_disabled | 2 (bpf() syscall restricted to privileged users, admin can change) |
JIT enable | 1 (enabled) |
JIT harden | 1 (enabled for unprivileged users) |
JIT kallsyms | 1 (enabled for root) |
Memory limit for JIT for unprivileged users | 69267617742848 |
CONFIG_BPF | y |
CONFIG_BPF_SYSCALL | y |
CONFIG_HAVE_EBPF_JIT | y |
CONFIG_BPF_JIT | y |
CONFIG_BPF_JIT_ALWAYS_ON | y |
CONFIG_DEBUG_INFO_BTF | y |
CONFIG_DEBUG_INFO_BTF_MODULES | y |
CONFIG_CGROUPS | y |
CONFIG_CGROUP_BPF | y |
CONFIG_CGROUP_NET_CLASSID | y |
CONFIG_SOCK_CGROUP_DATA | y |
CONFIG_BPF_EVENTS | y |
CONFIG_KPROBE_EVENTS | y |
CONFIG_UPROBE_EVENTS | y |
CONFIG_TRACING | y |
CONFIG_FTRACE_SYSCALLS | y |
CONFIG_FUNCTION_ERROR_INJECTION | n |
CONFIG_BPF_KPROBE_OVERRIDE | n |
CONFIG_NET | y |
CONFIG_XDP_SOCKETS | y |
CONFIG_LWTUNNEL_BPF | y |
CONFIG_NET_ACT_BPF | m |
CONFIG_NET_CLS_BPF | m |
CONFIG_NET_CLS_ACT | y |
CONFIG_NET_SCH_INGRESS | m |
CONFIG_XFRM | y |
CONFIG_IP_ROUTE_CLASSID | y |
CONFIG_IPV6_SEG6_BPF | y |
CONFIG_BPF_LIRC_MODE2 | n |
CONFIG_BPF_STREAM_PARSER | y |
CONFIG_NETFILTER_XT_MATCH_BPF | m |
CONFIG_BPFILTER | n |
CONFIG_BPFILTER_UMH | n |
CONFIG_TEST_BPF | m |
CONFIG_HZ | 100 |
bpf() syscall | available |
Large insn size limit | available |
Bounded loop support | available |
ISA extension v2 | available |
ISA extension v3 | available |
Program type | Available helpers |
---|---|
socket_filter | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_perf_event_output, bpf_skb_load_bytes, bpf_get_current_task, bpf_get_numa_node_id, bpf_get_socket_cookie, bpf_get_socket_uid, bpf_skb_load_bytes_relative, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
kprobe | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_probe_read, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_pid_tgid, bpf_get_current_uid_gid, bpf_get_current_comm, bpf_perf_event_read, bpf_perf_event_output, bpf_get_stackid, bpf_get_current_task, bpf_current_task_under_cgroup, bpf_get_numa_node_id, bpf_probe_read_str, bpf_perf_event_read_value, bpf_get_stack, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_send_signal, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_send_signal_thread, bpf_jiffies64, bpf_get_ns_current_pid_tgid, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_get_task_stack, bpf_copy_from_user, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_task_storage_get, bpf_task_storage_delete, bpf_get_current_task_btf, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_get_func_ip, bpf_get_attach_cookie, bpf_task_pt_regs, bpf_get_branch_snapshot, bpf_find_vma, bpf_loop, bpf_strncmp, bpf_copy_from_user_task, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
sched_cls | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_skb_store_bytes, bpf_l3_csum_replace, bpf_l4_csum_replace, bpf_tail_call, bpf_clone_redirect, bpf_get_cgroup_classid, bpf_skb_vlan_push, bpf_skb_vlan_pop, bpf_skb_get_tunnel_key, bpf_skb_set_tunnel_key, bpf_redirect, bpf_get_route_realm, bpf_perf_event_output, bpf_skb_load_bytes, bpf_csum_diff, bpf_skb_get_tunnel_opt, bpf_skb_set_tunnel_opt, bpf_skb_change_proto, bpf_skb_change_type, bpf_skb_under_cgroup, bpf_get_hash_recalc, bpf_get_current_task, bpf_skb_change_tail, bpf_skb_pull_data, bpf_csum_update, bpf_set_hash_invalid, bpf_get_numa_node_id, bpf_skb_change_head, bpf_get_socket_cookie, bpf_get_socket_uid, bpf_set_hash, bpf_skb_adjust_room, bpf_skb_get_xfrm_state, bpf_skb_load_bytes_relative, bpf_fib_lookup, bpf_skb_cgroup_id, bpf_get_current_cgroup_id, bpf_skb_ancestor_cgroup_id, bpf_sk_lookup_tcp, bpf_sk_lookup_udp, bpf_sk_release, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_sk_fullsock, bpf_tcp_sock, bpf_skb_ecn_set_ce, bpf_get_listener_sock, bpf_skc_lookup_tcp, bpf_tcp_check_syncookie, bpf_strtol, bpf_strtoul, bpf_sk_storage_get, bpf_sk_storage_delete, bpf_tcp_gen_syncookie, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_sk_assign, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_csum_level, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_skb_cgroup_classid, bpf_redirect_neigh, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_redirect_peer, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_check_mtu, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_skb_set_tstamp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_tcp_raw_gen_syncookie_ipv4, bpf_tcp_raw_gen_syncookie_ipv6, bpf_tcp_raw_check_syncookie_ipv4, bpf_tcp_raw_check_syncookie_ipv6, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
sched_act | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_skb_store_bytes, bpf_l3_csum_replace, bpf_l4_csum_replace, bpf_tail_call, bpf_clone_redirect, bpf_get_cgroup_classid, bpf_skb_vlan_push, bpf_skb_vlan_pop, bpf_skb_get_tunnel_key, bpf_skb_set_tunnel_key, bpf_redirect, bpf_get_route_realm, bpf_perf_event_output, bpf_skb_load_bytes, bpf_csum_diff, bpf_skb_get_tunnel_opt, bpf_skb_set_tunnel_opt, bpf_skb_change_proto, bpf_skb_change_type, bpf_skb_under_cgroup, bpf_get_hash_recalc, bpf_get_current_task, bpf_skb_change_tail, bpf_skb_pull_data, bpf_csum_update, bpf_set_hash_invalid, bpf_get_numa_node_id, bpf_skb_change_head, bpf_get_socket_cookie, bpf_get_socket_uid, bpf_set_hash, bpf_skb_adjust_room, bpf_skb_get_xfrm_state, bpf_skb_load_bytes_relative, bpf_fib_lookup, bpf_skb_cgroup_id, bpf_get_current_cgroup_id, bpf_skb_ancestor_cgroup_id, bpf_sk_lookup_tcp, bpf_sk_lookup_udp, bpf_sk_release, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_sk_fullsock, bpf_tcp_sock, bpf_skb_ecn_set_ce, bpf_get_listener_sock, bpf_skc_lookup_tcp, bpf_tcp_check_syncookie, bpf_strtol, bpf_strtoul, bpf_sk_storage_get, bpf_sk_storage_delete, bpf_tcp_gen_syncookie, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_sk_assign, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_csum_level, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_skb_cgroup_classid, bpf_redirect_neigh, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_redirect_peer, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_check_mtu, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_skb_set_tstamp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_tcp_raw_gen_syncookie_ipv4, bpf_tcp_raw_gen_syncookie_ipv6, bpf_tcp_raw_check_syncookie_ipv4, bpf_tcp_raw_check_syncookie_ipv6, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
tracepoint | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_probe_read, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_pid_tgid, bpf_get_current_uid_gid, bpf_get_current_comm, bpf_perf_event_read, bpf_perf_event_output, bpf_get_stackid, bpf_get_current_task, bpf_current_task_under_cgroup, bpf_get_numa_node_id, bpf_probe_read_str, bpf_perf_event_read_value, bpf_get_stack, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_send_signal, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_send_signal_thread, bpf_jiffies64, bpf_get_ns_current_pid_tgid, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_get_task_stack, bpf_copy_from_user, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_task_storage_get, bpf_task_storage_delete, bpf_get_current_task_btf, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_get_func_ip, bpf_get_attach_cookie, bpf_task_pt_regs, bpf_get_branch_snapshot, bpf_find_vma, bpf_loop, bpf_strncmp, bpf_copy_from_user_task, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
xdp | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_redirect, bpf_perf_event_output, bpf_csum_diff, bpf_get_current_task, bpf_get_numa_node_id, bpf_xdp_adjust_head, bpf_redirect_map, bpf_xdp_adjust_meta, bpf_xdp_adjust_tail, bpf_fib_lookup, bpf_get_current_cgroup_id, bpf_sk_lookup_tcp, bpf_sk_lookup_udp, bpf_sk_release, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_skc_lookup_tcp, bpf_tcp_check_syncookie, bpf_strtol, bpf_strtoul, bpf_tcp_gen_syncookie, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_check_mtu, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_xdp_get_buff_len, bpf_xdp_load_bytes, bpf_xdp_store_bytes, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_tcp_raw_gen_syncookie_ipv4, bpf_tcp_raw_gen_syncookie_ipv6, bpf_tcp_raw_check_syncookie_ipv4, bpf_tcp_raw_check_syncookie_ipv6, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
perf_event | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_probe_read, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_pid_tgid, bpf_get_current_uid_gid, bpf_get_current_comm, bpf_perf_event_read, bpf_perf_event_output, bpf_get_stackid, bpf_get_current_task, bpf_current_task_under_cgroup, bpf_get_numa_node_id, bpf_probe_read_str, bpf_perf_event_read_value, bpf_perf_prog_read_value, bpf_get_stack, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_send_signal, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_send_signal_thread, bpf_jiffies64, bpf_read_branch_records, bpf_get_ns_current_pid_tgid, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_get_task_stack, bpf_copy_from_user, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_task_storage_get, bpf_task_storage_delete, bpf_get_current_task_btf, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_get_func_ip, bpf_get_attach_cookie, bpf_task_pt_regs, bpf_get_branch_snapshot, bpf_find_vma, bpf_loop, bpf_strncmp, bpf_copy_from_user_task, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
cgroup_skb | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_perf_event_output, bpf_skb_load_bytes, bpf_get_current_task, bpf_get_numa_node_id, bpf_get_socket_cookie, bpf_get_socket_uid, bpf_skb_load_bytes_relative, bpf_skb_cgroup_id, bpf_get_current_cgroup_id, bpf_get_local_storage, bpf_skb_ancestor_cgroup_id, bpf_sk_lookup_tcp, bpf_sk_lookup_udp, bpf_sk_release, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_sk_fullsock, bpf_tcp_sock, bpf_skb_ecn_set_ce, bpf_get_listener_sock, bpf_skc_lookup_tcp, bpf_strtol, bpf_strtoul, bpf_sk_storage_get, bpf_sk_storage_delete, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_sk_cgroup_id, bpf_sk_ancestor_cgroup_id, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
cgroup_sock | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_pid_tgid, bpf_get_current_uid_gid, bpf_get_current_comm, bpf_get_cgroup_classid, bpf_perf_event_output, bpf_get_current_task, bpf_get_numa_node_id, bpf_get_socket_cookie, bpf_get_current_cgroup_id, bpf_get_local_storage, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_sk_storage_get, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_netns_cookie, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_loop, bpf_strncmp, bpf_get_retval, bpf_set_retval, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
lwt_in | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_cgroup_classid, bpf_get_route_realm, bpf_perf_event_output, bpf_skb_load_bytes, bpf_csum_diff, bpf_skb_under_cgroup, bpf_get_hash_recalc, bpf_get_current_task, bpf_skb_pull_data, bpf_get_numa_node_id, bpf_lwt_push_encap, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
lwt_out | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_cgroup_classid, bpf_get_route_realm, bpf_perf_event_output, bpf_skb_load_bytes, bpf_csum_diff, bpf_skb_under_cgroup, bpf_get_hash_recalc, bpf_get_current_task, bpf_skb_pull_data, bpf_get_numa_node_id, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
lwt_xmit | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_skb_store_bytes, bpf_l3_csum_replace, bpf_l4_csum_replace, bpf_tail_call, bpf_clone_redirect, bpf_get_cgroup_classid, bpf_skb_get_tunnel_key, bpf_skb_set_tunnel_key, bpf_redirect, bpf_get_route_realm, bpf_perf_event_output, bpf_skb_load_bytes, bpf_csum_diff, bpf_skb_get_tunnel_opt, bpf_skb_set_tunnel_opt, bpf_skb_under_cgroup, bpf_get_hash_recalc, bpf_get_current_task, bpf_skb_change_tail, bpf_skb_pull_data, bpf_csum_update, bpf_set_hash_invalid, bpf_get_numa_node_id, bpf_skb_change_head, bpf_lwt_push_encap, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_csum_level, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
sock_ops | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_perf_event_output, bpf_get_current_task, bpf_get_numa_node_id, bpf_get_socket_cookie, bpf_setsockopt, bpf_sock_map_update, bpf_getsockopt, bpf_sock_ops_cb_flags_set, bpf_sock_hash_update, bpf_get_current_cgroup_id, bpf_get_local_storage, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_tcp_sock, bpf_strtol, bpf_strtoul, bpf_sk_storage_get, bpf_sk_storage_delete, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_netns_cookie, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_load_hdr_opt, bpf_store_hdr_opt, bpf_reserve_hdr_opt, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
sk_skb | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_skb_store_bytes, bpf_tail_call, bpf_perf_event_output, bpf_skb_load_bytes, bpf_get_current_task, bpf_skb_change_tail, bpf_skb_pull_data, bpf_get_numa_node_id, bpf_skb_change_head, bpf_get_socket_cookie, bpf_get_socket_uid, bpf_skb_adjust_room, bpf_sk_redirect_map, bpf_sk_redirect_hash, bpf_get_current_cgroup_id, bpf_sk_lookup_tcp, bpf_sk_lookup_udp, bpf_sk_release, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_skc_lookup_tcp, bpf_strtol, bpf_strtoul, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
cgroup_device | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_pid_tgid, bpf_get_current_uid_gid, bpf_get_current_comm, bpf_get_cgroup_classid, bpf_perf_event_output, bpf_get_current_task, bpf_get_numa_node_id, bpf_get_current_cgroup_id, bpf_get_local_storage, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
sk_msg | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_pid_tgid, bpf_get_current_uid_gid, bpf_get_cgroup_classid, bpf_perf_event_output, bpf_get_current_task, bpf_get_numa_node_id, bpf_msg_redirect_map, bpf_msg_apply_bytes, bpf_msg_cork_bytes, bpf_msg_pull_data, bpf_msg_redirect_hash, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_msg_push_data, bpf_msg_pop_data, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_sk_storage_get, bpf_sk_storage_delete, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_netns_cookie, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
raw_tracepoint | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_probe_read, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_pid_tgid, bpf_get_current_uid_gid, bpf_get_current_comm, bpf_perf_event_read, bpf_perf_event_output, bpf_get_stackid, bpf_get_current_task, bpf_current_task_under_cgroup, bpf_get_numa_node_id, bpf_probe_read_str, bpf_perf_event_read_value, bpf_get_stack, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_send_signal, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_send_signal_thread, bpf_jiffies64, bpf_get_ns_current_pid_tgid, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_get_task_stack, bpf_copy_from_user, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_task_storage_get, bpf_task_storage_delete, bpf_get_current_task_btf, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_get_func_ip, bpf_task_pt_regs, bpf_get_branch_snapshot, bpf_find_vma, bpf_loop, bpf_strncmp, bpf_copy_from_user_task, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
cgroup_sock_addr | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_pid_tgid, bpf_get_current_uid_gid, bpf_get_current_comm, bpf_get_cgroup_classid, bpf_perf_event_output, bpf_get_current_task, bpf_get_numa_node_id, bpf_get_socket_cookie, bpf_setsockopt, bpf_getsockopt, bpf_bind, bpf_get_current_cgroup_id, bpf_get_local_storage, bpf_sk_lookup_tcp, bpf_sk_lookup_udp, bpf_sk_release, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_skc_lookup_tcp, bpf_strtol, bpf_strtoul, bpf_sk_storage_get, bpf_sk_storage_delete, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_netns_cookie, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_get_retval, bpf_set_retval, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
lwt_seg6local | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_cgroup_classid, bpf_get_route_realm, bpf_perf_event_output, bpf_skb_load_bytes, bpf_csum_diff, bpf_skb_under_cgroup, bpf_get_hash_recalc, bpf_get_current_task, bpf_skb_pull_data, bpf_get_numa_node_id, bpf_lwt_seg6_store_bytes, bpf_lwt_seg6_adjust_srh, bpf_lwt_seg6_action, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
lirc_mode2 | not supported |
sk_reuseport | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_skb_load_bytes, bpf_get_current_task, bpf_get_numa_node_id, bpf_get_socket_cookie, bpf_skb_load_bytes_relative, bpf_get_current_cgroup_id, bpf_sk_select_reuseport, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
flow_dissector | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_skb_load_bytes, bpf_get_current_task, bpf_get_numa_node_id, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
cgroup_sysctl | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_pid_tgid, bpf_get_current_uid_gid, bpf_get_current_comm, bpf_get_cgroup_classid, bpf_perf_event_output, bpf_get_current_task, bpf_get_numa_node_id, bpf_get_current_cgroup_id, bpf_get_local_storage, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_sysctl_get_name, bpf_sysctl_get_current_value, bpf_sysctl_get_new_value, bpf_sysctl_set_new_value, bpf_strtol, bpf_strtoul, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
raw_tracepoint_writable | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_probe_read, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_pid_tgid, bpf_get_current_uid_gid, bpf_get_current_comm, bpf_perf_event_read, bpf_perf_event_output, bpf_get_stackid, bpf_get_current_task, bpf_current_task_under_cgroup, bpf_get_numa_node_id, bpf_probe_read_str, bpf_perf_event_read_value, bpf_get_stack, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_send_signal, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_send_signal_thread, bpf_jiffies64, bpf_get_ns_current_pid_tgid, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_get_task_stack, bpf_copy_from_user, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_task_storage_get, bpf_task_storage_delete, bpf_get_current_task_btf, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_get_func_ip, bpf_task_pt_regs, bpf_get_branch_snapshot, bpf_find_vma, bpf_loop, bpf_strncmp, bpf_copy_from_user_task, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
cgroup_sockopt | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_pid_tgid, bpf_get_current_uid_gid, bpf_get_current_comm, bpf_get_cgroup_classid, bpf_perf_event_output, bpf_get_current_task, bpf_get_numa_node_id, bpf_get_current_cgroup_id, bpf_get_local_storage, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_tcp_sock, bpf_strtol, bpf_strtoul, bpf_sk_storage_get, bpf_sk_storage_delete, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_netns_cookie, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_loop, bpf_strncmp, bpf_get_retval, bpf_set_retval, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
tracing | |
struct_ops | |
ext | |
lsm | |
sk_lookup | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_perf_event_output, bpf_get_current_task, bpf_get_numa_node_id, bpf_get_current_cgroup_id, bpf_sk_release, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_sk_assign, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_ktime_get_coarse_ns, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_skc_to_unix_sock, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
syscall | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_probe_read, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_pid_tgid, bpf_get_current_uid_gid, bpf_get_current_comm, bpf_perf_event_read, bpf_perf_event_output, bpf_get_stackid, bpf_get_current_task, bpf_current_task_under_cgroup, bpf_get_numa_node_id, bpf_probe_read_str, bpf_get_socket_cookie, bpf_perf_event_read_value, bpf_get_stack, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_sk_storage_get, bpf_sk_storage_delete, bpf_send_signal, bpf_skb_output, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_send_signal_thread, bpf_jiffies64, bpf_get_ns_current_pid_tgid, bpf_xdp_output, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_skc_to_tcp6_sock, bpf_skc_to_tcp_sock, bpf_skc_to_tcp_timewait_sock, bpf_skc_to_tcp_request_sock, bpf_skc_to_udp6_sock, bpf_get_task_stack, bpf_d_path, bpf_copy_from_user, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_task_storage_get, bpf_task_storage_delete, bpf_get_current_task_btf, bpf_sock_from_file, bpf_for_each_map_elem, bpf_snprintf, bpf_sys_bpf, bpf_btf_find_by_name_kind, bpf_sys_close, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_get_func_ip, bpf_task_pt_regs, bpf_get_branch_snapshot, bpf_skc_to_unix_sock, bpf_kallsyms_lookup_name, bpf_find_vma, bpf_loop, bpf_strncmp, bpf_xdp_get_buff_len, bpf_copy_from_user_task, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_skc_to_mptcp_sock, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
netfilter | bpf_map_lookup_elem, bpf_map_update_elem, bpf_map_delete_elem, bpf_ktime_get_ns, bpf_get_prandom_u32, bpf_get_smp_processor_id, bpf_tail_call, bpf_get_current_task, bpf_get_numa_node_id, bpf_get_current_cgroup_id, bpf_map_push_elem, bpf_map_pop_elem, bpf_map_peek_elem, bpf_spin_lock, bpf_spin_unlock, bpf_strtol, bpf_strtoul, bpf_probe_read_user, bpf_probe_read_kernel, bpf_probe_read_user_str, bpf_probe_read_kernel_str, bpf_jiffies64, bpf_get_current_ancestor_cgroup_id, bpf_ktime_get_boot_ns, bpf_ringbuf_output, bpf_ringbuf_reserve, bpf_ringbuf_submit, bpf_ringbuf_discard, bpf_ringbuf_query, bpf_snprintf_btf, bpf_per_cpu_ptr, bpf_this_cpu_ptr, bpf_get_current_task_btf, bpf_for_each_map_elem, bpf_snprintf, bpf_timer_init, bpf_timer_set_callback, bpf_timer_start, bpf_timer_cancel, bpf_task_pt_regs, bpf_loop, bpf_strncmp, bpf_kptr_xchg, bpf_map_lookup_percpu_elem, bpf_dynptr_from_mem, bpf_ringbuf_reserve_dynptr, bpf_ringbuf_submit_dynptr, bpf_ringbuf_discard_dynptr, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data, bpf_ktime_get_tai_ns, bpf_user_ringbuf_drain, bpf_cgrp_storage_get, bpf_cgrp_storage_delete |
Map type | Available |
---|---|
hash | yes |
array | yes |
prog_array | yes |
perf_event_array | yes |
percpu_hash | yes |
percpu_array | yes |
stack_trace | yes |
cgroup_array | yes |
lru_hash | yes |
lru_percpu_hash | yes |
lpm_trie | yes |
array_of_maps | yes |
hash_of_maps | yes |
devmap | yes |
sockmap | yes |
cpumap | yes |
xskmap | yes |
sockhash | yes |
cgroup_storage | yes |
reuseport_sockarray | yes |
percpu_cgroup_storage | yes |
queue | yes |
stack | yes |
sk_storage | yes |
devmap_hash | yes |
struct_ops | yes |
ringbuf | yes |
inode_storage | yes |
task_storage | yes |
bloom_filter | yes |
user_ringbuf | yes |
cgrp_storage | yes |
arena_map | yes |
Appendix A. List of tickets by component
Bugzilla and JIRA tickets are listed in this document for reference. The links lead to the release notes in this document that describe the tickets.
Appendix B. Revision history
0.0-1
Tue Jul 01 2025, Marc Muehlfeld (mmuehlfeld@redhat.com)
- Added two Technology Previews RHEL-5852 and RHELDOCS-20472 (Networking)
0.0-0
Tue 20 May 2025, Gabriela Fialová (gfialova@redhat.com)
- Release of the Red Hat Enterprise Linux 10.0 Release Notes.