8.0 Release Notes

A firewall interface has been added to the web console

The Networking page in the RHEL 8 web console now includes a Firewall section. In this section, users can enable or disable the firewall, as well as add, remove, and modify firewall rules.

The web console is now available by default

Packages for the RHEL 8 web console, also known as Cockpit, are now part of Red Hat Enterprise Linux default repositories, and can therefore be immediately installed on a registered RHEL 8 system.

Better IdM integration for the web console

If your system is enrolled in an Identity Management (IdM) domain, the RHEL 8 web console now uses the domain’s centrally managed IdM resources by default. This includes the following benefits:

The web console is now compatible with mobile browsers

With this update, the web console menus and pages can be navigated on mobile browser variants. This makes it possible to manage systems using the RHEL 8 web console from a mobile device.

The web console front page now displays missing updates and subscriptions

If a system managed by the RHEL 8 web console has outdated packages or a lapsed subscription, a warning is now displayed on the web console front page of the system.

The web console now supports PBD enrollment

With this update, you can use the the RHEL 8 web console interface to apply Policy-Based Decryption (PBD) rules to disks on managed systems. This uses the Clevis decryption client to facilitate a variety of security management functions in the web console, such as automatic unlocking of LUKS-encrypted disk partitions.

Virtual Machines can now be managed using the web console

The Virtual Machines page can now be added to the RHEL 8 web console interface, which enables the user to create and manage libvirt-based virtual machines.

Installing RHEL from a DVD using SE and HMC is now fully supported on IBM Z

The installation of Red Hat Enterprise Linux 8 on IBM Z hardware from a DVD using the Support Element (SE) and Hardware Management Console (HMC) is now fully supported. This addition simplifies the installation process on IBM Z with SE and HMC.

Installer now supports the LUKS2 disk encryption format

Red Hat Enterprise Linux 8 installer now uses the LUKS2 format by default but you can select a LUKS version from Anaconda’s Custom Partitioning window or by using the new options in Kickstart’s autopart, logvol, part, and RAID commands.

Anaconda supports System Purpose in RHEL 8

Previously, Anaconda did not provide system purpose information to Subscription Manager. In Red Hat Enterprise Linux 8.0, you can set the intended purpose of the system during installation by using Anaconda’s System Purpose window or Kickstart’s syspurpose command. When the installation completes, Subscription Manager uses the system purpose information when subscribing the system.

Pykickstart supports System Purpose in RHEL 8

Previously, it was not possible for the pykickstart library to provide system purpose information to Subscription Manager. In Red Hat Enterprise Linux 8.0, pykickstart parses the new syspurpose command and records the intended purpose of the system during automated and partially-automated installation. The information is then passed to Anaconda, saved on the newly-installed system, and available for Subscription Manager when subscribing the system.

Anaconda supports a new kernel boot parameter in RHEL 8

Previously, you could only specify a base repository from the kernel boot parameters. In Red Hat Enterprise Linux 8, a new kernel parameter, inst.addrepo=<name>,<url>, allows you to specify an additional repository during installation.

Anaconda supports a unified ISO in RHEL 8

In Red Hat Enterprise Linux 8.0, a unified ISO automatically loads the BaseOS and AppStream installation source repositories.

Anaconda can install modular packages in Kickstart scripts

The Anaconda installer has been extended to handle all features related to application streams: modules, streams and profiles. Kickstart scripts can now enable module and stream combinations, install module profiles, and install modular packages. For more information, see Performing an advanced RHEL installation.

The nosmt boot option is now available in the RHEL 8 installation options

The nosmt boot option is available in the installation options that are passed to a newly-installed RHEL 8 system.

RHEL 8 supports installing from a repository on a local hard drive

Previously, installing RHEL from a hard drive required an ISO image as the installation source. However, the RHEL 8 ISO image might be too large for some file systems; for example, the FAT32 file system cannot store files larger than 4 GiB.

Custom system image creation with Image Builder is available in RHEL 8

The Image Builder tool enables users to create customized RHEL images. Image Builder is available in AppStream in the lorax-composer package.

Added new kickstart commands: authselect and modules

With this release, the following kickstart commands are added:

Kernel version in RHEL 8.0

Red Hat Enterprise Linux 8.0 is distributed with the kernel version 4.18.0-80.

ARM 52-bit physical addressing is now available

With this update, support for 52-bit physical addressing (PA) for the 64-bit ARM architecture is available. This provides larger address space than previous 48-bit PA.

The IOMMU code supports 5-level page tables in RHEL 8

The I/O memory management unit (IOMMU) code in the Linux kernel has been updated to support 5-level page tables in Red Hat Enterprise Linux 8.

Support for 5-level paging

New P4d_t software page table type has been added into the Linux kernel in order to support 5-level paging in Red Hat Enterprise Linux 8.

Memory management supports 5-level page tables

With Red Hat Enterprise Linux 7, existing memory bus had 48/46 bit of virtual/physical memory addressing capacity, and the Linux kernel implemented 4 levels of page tables to manage these virtual addresses to physical addresses. The physical bus addressing line put the physical memory upper limit capacity at 64 TB.

kernel-signing-ca.cer is moved to kernel-core in RHEL 8

In all versions of Red Hat Enterprise Linux 7, the kernel-signing-ca.cer public key was located in the kernel-doc package. However, in Red Hat Enterprise Linux 8, kernel-signing-ca.cer has been relocated to the kernel-core package for every architecture.

Spectre V2 mitigation default changed from IBRS to Retpolines

The default mitigation for the Spectre V2 vulnerability (CVE-2017-5715) for systems with the 6th Generation Intel Core Processors and its close derivatives [1] has changed from Indirect Branch Restricted Speculation (IBRS) to Retpolines in Red Hat Enterprise Linux 8. Red Hat has implemented this change as a result of Intel’s recommendations to align with the defaults used in the Linux community and to restore lost performance. However, note that using Retpolines in some cases may not fully mitigate Spectre V2. Intel’s Retpoline document [2] describes any cases of exposure. This document also states that the risk of an attack is low.

Intel® Omni-Path Architecture (OPA) Host Software

Intel Omni-Path Architecture (OPA) host software is fully supported in Red Hat Enterprise Linux 8.

NUMA supports more nodes in RHEL 8

With this update, the Non-Uniform Memory Access (NUMA) node count has been increased from 4 NUMA nodes to 8 NUMA nodes in Red Hat Enterprise Linux 8 on systems with the 64-bit ARM architecture.

IOMMU passthrough is now enabled by default in RHEL 8

The Input/Output Memory Management Unit (IOMMU) passthrough has been enabled by default. This provides improved performance for AMD systems because Direct Memory Access (DMA) remapping is disabled for the host. This update brings consistency with Intel systems where DMA remapping is also disabled by default. Users may disable such behavior (and enable DMA remapping) by specifying either iommu.passthrough=off or iommu=nopt parameters on the kernel command line, including the hypervisor.

RHEL8 kernel now supports 5-level page tables

Red Hat Enterprise Linux kernel now fully supports future Intel processors with up to 5 levels of page tables. This enables the processors to support up to 4PB of physical memory and 128PB of virtual address space. Applications that utilize large amounts of memory can now use as much memory as possible as provided by the system without the constraints of 4-level page tables.

RHEL8 kernel supports enhanced IBRS for future Intel CPUs

Red Hat Enterprise Linux kernel now supports the use of enhanced Indirect Branch Restricted Speculation (IBRS) capability to mitigate the Spectre V2 vulnerability. When enabled, IBRS will perform better than Retpolines (default) to mitigate Spectre V2 and will not interfere with Intel Control-flow Enforcement technology. As a result, the performance penalty of enabling the mitigation for Spectre V2 will be smaller on future Intel CPUs.

bpftool for inspection and manipulation of eBPF-based programs and maps added

The bpftool utility that serves for inspection and simple manipulation of programs and maps based on extended Berkeley Packet Filtering (eBPF) has been added into the Linux kernel. bpftool is a part of the kernel source tree, and is provided by the bpftool package, which is included as a sub-package of the kernel package.

The kernel-rt sources have been updated

The kernel-rt sources have been updated to use the latest RHEL kernel source tree. The latest kernel source tree is now using the upstream v4.18 realtime patch set, which provides a number of bug fixes and enhancements over the previous version.

YUM performance improvement and support for modular content

On Red Hat Enterprise Linux 8, installing software is ensured by the new version of the YUM tool, which is based on the DNF technology (YUM v4).

Notable RPM features in RHEL 8

Red Hat Enterprise Linux 8 is distributed with RPM 4.14. This version introduces many enhancements over RPM 4.11, which is available in RHEL 7. The most notable features include:

RPM now validates the entire package contents before starting an installation

On Red Hat Enterprise Linux 7, the RPM utility verified payload contents of individual files while unpacking. However, this is insufficient for multiple reasons:

Notable changes in the recommended Tuned profile in RHEL 8

With this update, the recommended Tuned profile (reported by the tuned-adm recommend command) is now selected based on the following rules - the first rule that matches takes effect:

Files produced by named can be written in the working directory

Previously, the named daemon stored some data in the working directory, which has been read-only in Red Hat Enterprise Linux. With this update, paths have been changed for selected files into subdirectories, where writing is allowed. Now, default directory Unix and SELinux permissions allow writing into the directory. Files distributed inside the directory are still read-only to named.

Geolite Databases have been replaced by Geolite2 Databases

Geolite Databases that were present in Red Hat Enterprise Linux 7 were replaced by Geolite2 Databases on Red Hat Enterprise Linux 8.

CUPS logs are handled by journald

In RHEL 8, the CUPS logs are no longer stored in specific files within the /var/log/cups directory, which was used in RHEL 7. In RHEL 8, all types of CUPS logs are centrally-logged in the systemd journald daemon together with logs from other programs. To access the CUPS logs, use the journalctl -u cups command. For more information, see Accessing the CUPS logs in the systemd journal.

Notable BIND features in RHEL 8

RHEL 8 includes BIND (Berkeley Internet Name Domain) in version 9.11. This version of the DNS server introduces multiple new features and feature changes compared to version 9.10.

The nobody user replaces nfsnobody

In Red Hat Enterprise Linux 7, there was:

Version control systems in RHEL 8

RHEL 8 provides the following version control systems:

Notable changes in Subversion 1.10

Subversion 1.10 introduces a number of new features since the version 1.7 distributed in RHEL 7, as well as the following compatibility changes:

Notable changes in dstat

RHEL 8 is distributed with a new version of the dstat tool. This tool is now a part of the Performance Co-Pilot (PCP) toolkit. The /usr/bin/dstat file and the dstat package name is now provided by the pcp-system-tools package.

Python 3 is the default Python implementation in RHEL 8

Red Hat Enterprise Linux 8 is distributed with Python 3.6. The package might not be installed by default. To install Python 3.6, use the yum install python3 command.

Python scripts must specify major version in interpreter directives at RPM build time

In RHEL 8, executable Python scripts are expected to use interpreter directives (hashbangs) specifying explicitly at least the major Python version.

Notable changes in PHP

Red Hat Enterprise Linux 8 is distributed with PHP 7.2. This version introduces the following major changes over PHP 5.4, which is available in RHEL 7:

Notable changes in Ruby

RHEL 8 provides Ruby 2.5, which introduces numerous new features and enhancements over Ruby 2.0.0 available in RHEL 7. Notable changes include:

Notable changes in Perl

Perl 5.26, distributed with RHEL 8, introduces the following changes over the version available in RHEL 7:

Node.js new in RHEL

Node.js, a software development platform for building fast and scalable network applications in the JavaScript programming language, is provided for the first time in RHEL. It was previously available only as a Software Collection. RHEL 8 provides Node.js 10.

Notable changes in SWIG

RHEL 8 includes the Simplified Wrapper and Interface Generator (SWIG) version 3.0, which provides numerous new features, enhancements, and bug fixes over the version 2.0 distributed in RHEL 7. Most notably, support for the C++11 standard has been implemented. SWIG now supports also Go 1.6, PHP 7, Octave 4.2, and Python 3.5.

Notable changes in Apache httpd

RHEL 8 is distributed with the Apache HTTP Server 2.4.37. This version introduces the following changes over httpd available in RHEL 7:

The nginx web server new in RHEL

RHEL 8 introduces nginx 1.14, a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. nginx was previously available only as a Software Collection.

Database servers in RHEL 8

RHEL 8 provides the following database servers:

Notable changes in MySQL 8.0

RHEL 8 is distributed with MySQL 8.0, which provides, for example, the following enhancements:

Notable changes in MariaDB 10.3

MariaDB 10.3 provides numerous new features over the version 5.5 distributed in RHEL 7, such as:

Notable changes in PostgreSQL

RHEL 8.0 provides two versions of the PostgreSQL database server, distributed in two streams of the postgresql module: PostgreSQL 10 (the default stream) and PostgreSQL 9.6. RHEL 7 includes PostgreSQL version 9.2.

Notable changes in Squid

RHEL 8.0 is distributed with Squid 4.4, a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. This release provides numerous new features, enhancements, and bug fixes over the version 3.5 available in RHEL 7.

Varnish Cache new in RHEL

Varnish Cache, a high-performance HTTP reverse proxy, is provided for the first time in RHEL. It was previously available only as a Software Collection. Varnish Cache stores files or fragments of files in memory that are used to reduce the response time and network bandwidth consumption on future equivalent requests. RHEL 8.0 is distributed with Varnish Cache 6.0.

GNOME Shell, version 3.28 in RHEL 8

GNOME Shell, version 3.28 is available in Red Hat Enterprise Linux (RHEL) 8. Notable enhancements include:

Wayland is the default display server

With Red Hat Enterprise Linux 8, the GNOME session and the GNOME Display Manager (GDM) use Wayland as their default display server instead of the X.org server, which was used with the previous major version of RHEL.

Locating RPM packages that are in repositories not enabled by default

Additional repositories for desktop are not enabled by default. The disablement is indicated by the enabled=0 line in the corresponding .repo file. If you attempt to install a package from such repository using PackageKit, PackageKit shows an error message announcing that the application is not available. To make the package available, replace previously used enabled=0 line in the respective .repo file with enabled=1.

GNOME Sofware for package management

The gnome-packagekit package that provided a collection of tools for package management in graphical environment on Red Hat Enterprise Linux 7 is no longer available. On Red Hat Enterprise Linux 8, similar functionality is provided by the GNOME Software utility, which enables you to install and update applications and gnome-shell extensions. GNOME Software is distributed in the gnome-software package.

Fractional scaling available for GNOME Shell on Wayland

On a GNOME Shell on Wayland session, the fractional scaling feature is available. The feature makes it possible to scale the GUI by fractions, which improves the appearance of scaled GUI on certain displays.

Firmware updates using fwupd are available

RHEL 8 supports firmware updates, such as UEFI capsule, Device Firmware Upgrade (DFU), and others, using the fwupd daemon. The daemon allows session software to update device firmware on a local machine automatically.

Memory Mode for Optane DC Persistent Memory technology is fully supported

Intel Optane DC Persistent Memory storage devices provide data center-class persistent memory technology, which can significantly increase transaction throughput.

New password syntax checks in Directory Server

This enhancement adds new password syntax checks to Directory Server. Administrators can now, for example, enable dictionary checks, allow or deny using character sequences and palindromes. As a result, if enabled, the password policy syntax check in Directory Server enforces more secure passwords.

Directory Server now provides improved internal operations logging support

Several operations in Directory Server, initiated by the server and clients, cause additional operations in the background. Previously, the server only logged for internal operations the Internal connection keyword, and the operation ID was always set to -1. With this enhancement, Directory Server logs the real connection and operation ID. You can now trace the internal operation to the server or client operation that caused this operation.

The tomcatjss library supports OCSP checking using the responder from the AIA extension

With this enhancement, the tomcatjss library supports Online Certificate Status Protocol (OCSP) checking using the responder from the Authority Information Access (AIA) extension of a certificate. As a result, administrators of Red Hat Certificate System can now configure OCSP checking that uses the URL from the AIA extension.

The pki subsystem-cert-find and pki subsystem-cert-show commands now show the serial number of certificates

With this enhancement, the pki subsystem-cert-find and pki subsystem-cert-show commands in Certificate System show the serial number of certificates in their output. The serial number is an important piece of information and often required by multiple other commands. As a result, identifying the serial number of a certificate is now easier.

The pki user and pki group commands have been deprecated in Certificate System

With this update, the new pki <subsystem>-user and pki <subsystem>-group commands replace the pki user and pki group commands in Certificate System. The replaced commands still works, but they display a message that the command is deprecated and refer to the new commands.

Certificate System now supports offline renewal of system certificates

With this enhancement, administrators can use the offline renewal feature to renew system certificates configured in Certificate System. When a system certificate expires, Certificate System fails to start. As a result of the enhancement, administrators no longer need workarounds to replace an expired system certificate.

Certificate System can now create CSRs with SKI extension for external CA signing

With this enhancement, Certificate System supports creating a certificate signing request (CSR) with the Subject Key Identifier (SKI) extension for external certificate authority (CA) signing. Certain CAs require this extension either with a particular value or derived from the CA public key. As a result, administrators can now use the pki_req_ski parameter in the configuration file passed to the pkispawn utility to create a CSR with SKI extension.

SSSD no longer uses the fallback_homedir value from the [nss] section as fallback for AD domains

Prior to RHEL 7.7, the SSSD fallback_homedir parameter in an Active Directory (AD) provider had no default value. If fallback_homedir was not set, SSSD used instead the value from the same parameter from the [nss] section in the /etc/sssd/sssd.conf file. To increase security, SSSD in RHEL 7.7 introduced a default value for fallback_homedir. As a consequence, SSSD no longer falls back to the value set in the [nss] section. If you want to use a different value than the default for the fallback_homedir parameter in an AD domain, you must manually set it in the domain’s section.

SSSD now allows you to select one of the multiple Smartcard authentication devices

By default, the System Security Services Daemon (SSSD) tries to detect a device for Smartcard authentication automatically. If there are multiple devices connected, SSSD selects the first one it detects. Consequently, you cannot select a particular device, which sometimes leads to failures.

Local users are cached by SSSD and served through the nss_sss module

In RHEL 8, the System Security Services Daemon (SSSD) serves users and groups from the /etc/passwd and /etc/groups files by default. The sss nsswitch module precedes files in the /etc/nsswitch.conf file.

KCM replaces KEYRING as the default credential cache storage

In RHEL 8, the default credential cache storage is the Kerberos Credential Manager (KCM) which is backed by the sssd-kcm deamon. KCM overcomes the limitations of the previously used KEYRING, such as its being difficult to use in containerized environments because it is not namespaced, and to view and manage quotas.

Active Directory users can now administer Identity Management

With this update, RHEL 8 allows adding a user ID override for an Active Directory (AD) user as a member of an Identity Management (IdM) group. An ID override is a record describing what a specific AD user or group properties should look like within a specific ID view, in this case the Default Trust View. As a consequence of the update, the IdM LDAP server is able to apply access control rules for the IdM group to the AD user.

sssctl prints an HBAC rules report for an IdM domain

With this update, the sssctl utility of the System Security Services Daemon (SSSD) can print an access control report for an Identity Management (IdM) domain. This feature meets the need of certain environments to see, for regulatory reasons, a list of users and groups that can access a specific client machine. Running sssctl access-report domain_name on an IdM client prints the parsed subset of host-based access control (HBAC) rules in the IdM domain that apply to the client machine.

Identity Management packages are available as a module

In RHEL 8, the packages necessary for installing an Identity Management (IdM) server and client are shipped as a module. The client stream is the default stream of the idm module and you can download the packages necessary for installing the client without enabling the stream.

Session recording solution for RHEL 8 added

A session recording solution has been added to Red Hat Enterprise Linux 8 (RHEL 8). A new tlog package and its associated web console session player enable to record and playback the user terminal sessions. The recording can be configured per user or user group via the System Security Services Daemon (SSSD) service. All terminal input and output is captured and stored in a text-based format in a system journal. The input is inactive by default for security reasons not to intercept raw passwords and other sensitive information.

authselect simplifies the configuration of user authentication

This update introduces the authselect utility that simplifies the configuration of user authentication on RHEL 8 hosts, replacing the authconfig utility. authselect comes with a safer approach to PAM stack management that makes the PAM configuration changes simpler for system administrators. authselect can be used to configure authentication methods such as passwords, certificates, smart cards, and fingerprint. Note that authselect does not configure services required to join remote domains. This task is performed by specialized tools, such as realmd or ipa-client-install.

SSSD now enforces AD GPOs by default

The default setting for the SSSD option ad_gpo_access_control is now enforcing. In RHEL 8, SSSD enforces access control rules based on Active Directory Group Policy Objects (GPOs) by default.

Boost updated to version 1.66

The Boost C++ library has been updated to upstream version 1.66. The version of Boost included in Red Hat Enterprise Linux 7 is 1.53. For details, see the upstream changelogs: https://www.boost.org/users/history/

Unicode 11.0.0 support

The Red Hat Enterprise Linux core C library, glibc, has been updated to support the Unicode standard version 11.0.0. As a result, all wide character and multi-byte character APIs including transliteration and conversion between character sets provide accurate and correct information conforming to this standard.

The boost package is now independent of Python

With this update, installing the boost package no longer installs the Boost.Python library as a dependency. In order to use Boost.Python, you need to explicitly install the boost-python3 or boost-python3-devel packages.

A new compat-libgfortran-48 package available

For compatibility with Red Hat Enterprise Linux 6 and 7 applications using the Fortran library, a new compat-libgfortran-48 compatibility package is now available, which provides the libgfortran.so.3 library.

Retpoline support in GCC

This update adds support for retpolines to GCC. A retpoline is a software construct used by the kernel to reduce overhead of mitigating Spectre Variant 2 attacks described in CVE-2017-5715.

Enhanced support for the 64-bit ARM architecture in toolchain components

Toolchain components, GCC and binutils, now provide extended support for the 64-bit ARM architecture. For example:

Optimizations to glibc for IBM POWER systems

This update provides a new version of glibc that is optimized for both IBM POWER 8 and IBM POWER 9 architectures. As a result, IBM POWER 8 and IBM POWER 9 systems now automatically switch to the appropriate, optimized glibc variant at run time.

GNU C Library updated to version 2.28

Red Hat Enterprise Linux 8 includes version 2.28 of the GNU C Library (glibc). Notable improvements include:

CMake available in RHEL

The CMake build system version 3.11 is available in Red Hat Enterprise Linux 8 as the cmake package.

make version 4.2.1

Red Hat Enterprise Linux 8 is distributed with the make build tool version 4.2.1. Notable changes include:

SystemTap version 4.0

Red Hat Enterprise Linux 8 is distributed with the SystemTap instrumentation tool version 4.0. Notable improvements include:

Improvements in binutils version 2.30

Red Hat Enterprise Linux 8 includes version 2.30 of the binutils package. Notable improvements include:

Performance Co-Pilot version 4.3.0

Red Hat Enterprise Linux 8 is distributed with Performance Co-Pilot (PCP) version 4.3.0. Notable improvements include:

Memory Protection Keys

This update enables hardware features which allow per-thread page protection flag changes. The new glibc system call wrappers have been added for the pkey_alloc(), pkey_free(), and pkey_mprotect() functions. In addition, the pkey_set() and pkey_get() functions have been added to allow access to the per-thread protection flags.

GCC now defaults to z13 on IBM Z

With this update, by default GCC on the IBM Z architecture builds code for the z13 processor, and the code is tuned for the z14 processor. This is equivalent to using the -march=z13 and -mtune=z14 options. Users can override this default by explicitly using options for target architecture and tuning.

elfutils updated to version 0.174

In Red Hat Enterprise Linux 8, the elfutils package is available in version 0.174. Notable changes include:

Valgrind updated to version 3.14

Red Hat Enterprise Linux 8 is distributed with the Valgrind executable code analysis tool version 3.14. Notable changes include:

GDB version 8.2

Red Hat Enterprise Linux 8 is distributed with the GDB debugger version 8.2 Notable changes include:

glibc localization for RHEL is distributed in multiple packages

In RHEL 8, glibc locales and translations are no longer provided by the single glibc-common package. Instead, every locale and language is available in a glibc-langpack-CODE package. Additionally, in most cases not all locales are installed by default, only these selected in the installer. Users must install all further locale packages that they need separately, or if they wish they can install glibc-all-langpacks to get the locales archive containing all the glibc locales installed as before.

GCC version 8.2

In Red Hat Enterprise Linux 8, the GCC toolchain is based on the GCC 8.2 release series. Notable changes include:

The Go cryptographic library FIPS mode now honors system settings

Previously, the Go standard cryptographic library always used its FIPS mode unless it was explicitly disabled at build time of the application using the library. As a consequence, users of Go-based applications could not control whether the FIPS mode was used. With this change, the library does not default to FIPS mode when the system is not configured in FIPS mode. As a result, users of Go-based applications on RHEL systems have more control over the use of the FIPS mode of the Go cryptographic library.

strace updated to version 4.24

Red Hat Enterprise Linux 8 is distributed with the strace tool version 4.24. Notable changes include:

Compiler toolsets in RHEL 8

RHEL 8.0 provides the following compiler toolsets as Application Streams:

Java implementations and Java tools in RHEL 8

The RHEL 8 AppStream repository includes:

C++ ABI change in std::string and std::list

The Application Binary Interface (ABI) of the std::string and std::list classes from the libstdc++ library changed between RHEL 7 (GCC 4.8) and RHEL 8 (GCC 8) to conform to the C++11 standard. The libstdc++ library supports both the old and new ABI, but some other C++ system libraries do not. As a consequence, applications that dynamically link against these libraries will need to be rebuilt. This affects all C++ standard modes, including C++98. It also affects applications built with Red Hat Developer Toolset compilers for RHEL 7, which kept the old ABI to maintain compatibility with the system libraries.

Support for Data Integrity Field/Data Integrity Extension (DIF/DIX)

DIF/DIX is supported on configurations where the hardware vendor has qualified it and provides full support for the particular host bus adapter (HBA) and storage array configuration on RHEL.

XFS now supports shared copy-on-write data extents

The XFS file system supports shared copy-on-write data extent functionality. This feature enables two or more files to share a common set of data blocks. When either of the files sharing common blocks changes, XFS breaks the link to common blocks and creates a new file. This is similar to the copy-on-write (COW) functionality found in other file systems.

Maximum XFS file system size is 1024 TiB

The maximum supported size of an XFS file system has been increased from 500 TiB to 1024 TiB.

ext4 file system now supports metadata checksum

With this update, ext4 metadata is protected by checksums. This enables the file system to recognize the corrupt metadata, which avoids damage and increases the file system resilience.

VDO now supports all architectures

Virtual Data Optimizer (VDO) is now available on all of the architectures supported by RHEL 8.

The BOOM boot manager simplifies the process of creating boot entries

BOOM is a boot manager for Linux systems that use boot loaders supporting the BootLoader Specification for boot entry configuration. It enables flexible boot configuration and simplifies the creation of new or modified boot entries: for example, to boot snapshot images of the system created using LVM.

LUKS2 is now the default format for encrypting volumes

In RHEL 8, the LUKS version 2 (LUKS2) format replaces the legacy LUKS (LUKS1) format. The dm-crypt subsystem and the cryptsetup tool now uses LUKS2 as the default format for encrypted volumes. LUKS2 provides encrypted volumes with metadata redundancy and auto-recovery in case of a partial metadata corruption event.

NVMe/FC is fully supported on Broadcom Emulex and Marvell Qlogic Fibre Channel adapters

The NVMe over Fibre Channel (NVMe/FC) transport type is now fully supported in Initiator mode when used with Broadcom Emulex and Marvell Qlogic Fibre Channel 32Gbit adapters that feature NVMe support.

New scan_lvs configuration setting

A new lvm.conf configuration file setting, scan_lvs, has been added and set to 0 by default. The new default behavior stops LVM from looking for PVs that may exist on top of LVs; that is, it will not scan active LVs for more PVs. The default setting also prevents LVM from creating PVs on top of LVs.

New overrides section of the DM Multipath configuration file

The /etc/multipath.conf file now includes an overrides section that allows you to set a configuration value for all of your devices. These attributes are used by DM Multipath for all devices unless they are overwritten by the attributes specified in the multipaths section of the /etc/multipath.conf file for paths that contain the device. This functionality replaces the all_devs parameter of the devices section of the configuration file, which is no longer supported.

Installing and booting from NVDIMM devices is now supported

Prior to this update, Nonvolatile Dual Inline Memory Module (NVDIMM) devices in any mode were ignored by the installer.

The detection of marginal paths in DM Multipath has been improved

The multipathd service now supports improved detection of marginal paths. This helps multipath devices avoid paths that are likely to fail repeatedly, and improves performance. Marginal paths are paths with persistent but intermittent I/O errors.

Multiqueue scheduling on block devices

Block devices now use multiqueue scheduling in Red Hat Enterprise Linux 8. This enables the block layer performance to scale well with fast solid-state drives (SSDs) and multi-core systems.

New pcs commands to list available watchdog devices and test watchdog devices

In order to configure SBD with Pacemaker, a functioning watchdog device is required. This release supports the pcs stonith sbd watchdog list command to list available watchdog devices on the local node, and the pcs stonith sbd watchdog test command to test a watchdog device. For information on the sbd command line tool, see the sbd(8) man page.

The pcs command now supports filtering resource failures by an operation and its interval

Pacemaker now tracks resource failures per a resource operation on top of a resource name, and a node. The pcs resource failcount show command now allows filtering failures by a resource, node, operation, and interval. It provides an option to display failures aggregated per a resource and node or detailed per a resource, node, operation, and its interval. Additionally, the pcs resource cleanup command now allows filtering failures by a resource, node, operation, and interval.

Timestamps enabled in corosync log

The corosync log did not previously contain timestamps, which made it difficult to relate it to logs from other nodes and daemons. With this release, timestamps are present in the corosync log.

New formats for pcs cluster setup, pcs cluster node add and pcs cluster node remove commands

In Red Hat Enterprise Linux 8, pcs fully supports Corosync 3, knet, and node names. Node names are now required and replace node addresses in the role of node identifier. Node addresses are now optional.

New pcs commands

Red Hat Enterprise Linux 8 introduces the following new commands.

Pacemaker 2.0.0 in RHEL 8

The pacemaker packages have been upgraded to the upstream version of Pacemaker 2.0.0, which provides a number of bug fixes and enhancements over the previous version:

Master resources renamed to promotable clone resources

Red Hat Enterprise Linux (RHEL) 8 supports Pacemaker 2.0, in which a master/slave resource is no longer a separate type of resource but a standard clone resource with a promotable meta-attribute set to true. The following changes have been implemented in support of this update:

New commands for authenticating nodes in a cluster

Red Hat Enterprise Linux (RHEL) 8 incorporates the following changes to the commands used to authenticate nodes in a cluster.

The pcs commands now support display, cleanup, and synchronization of fencing history

Pacemaker’s fence daemon tracks a history of all fence actions taken (pending, successful, and failed). With this release, the pcs commands allow users to access the fencing history in the following ways:

nftables replaces iptables as the default network packet filtering framework

The nftables framework provides packet classification facilities and it is the designated successor to the iptables, ip6tables, arptables, and ebtables tools. It offers numerous improvements in convenience, features, and performance over previous packet-filtering tools, most notably:

Notable TCP features in RHEL 8

Red Hat Enterprise Linux 8 is distributed with TCP networking stack version 4.18, which provides higher performances, better scalability, and more stability. Performances are boosted especially for busy TCP server with a high ingress connection rate.

firewalld uses nftables by default

With this update, the nftables filtering subsystem is the default firewall backend for the firewalld daemon. To change the backend, use the FirewallBackend option in the /etc/firewalld/firewalld.conf file.

Notable change in wpa_supplicant in RHEL 8

In Red Hat Enterprise Linux (RHEL) 8, the wpa_supplicant package is built with CONFIG_DEBUG_SYSLOG enabled. This allows reading the wpa_supplicant log using the journalctl utility instead of checking the contents of the /var/log/wpa_supplicant.log file.

NetworkManager now supports SR-IOV virtual functions

In Red Hat Enterprise Linux 8.0, NetworkManager allows configuring the number of virtual functions (VF) for interfaces that support single-root I/O virtualization (SR-IOV). Additionally, NetworkManager allows configuring some attributes of the VFs, such as the MAC address, VLAN, the spoof checking setting and allowed bitrates. Note that all properties related to SR-IOV are available in the sriov connection setting. For more details, see the nm-settings(5) man page.

IPVLAN virtual network drivers are now supported

In Red Hat Enterprise Linux 8.0, the kernel includes support for IPVLAN virtual network drivers. With this update, IPVLAN virtual Network Interface Cards (NICs) enable the network connectivity for multiple containers exposing a single MAC address to the local network. This allows a single host to have a lot of containers overcoming the possible limitation on the number of MAC addresses supported by the peer networking equipment.

NetworkManager supports a wildcard interface name match for connections

Previously, it was possible to restrict a connection to a given interface using only an exact match on the interface name. With this update, connections have a new match.interface-name property which supports wildcards. This update enables users to choose the interface for a connection in a more flexible way using a wildcard pattern.

Improvements in the networking stack 4.18

Red Hat Enterprise Linux 8.0 includes the networking stack upgraded to upstream version 4.18, which provides several bug fixes and enhancements. Notable changes include:

New tools to convert iptables to nftables

This update adds the iptables-translate and ip6tables-translate tools to convert the existing iptables or ip6tables rules into the equivalent ones for nftables. Note that some extensions lack translation support. If such an extension exists, the tool prints the untranslated rule prefixed with the # sign. For example:

New features added to VPN using NetworkManager

In Red Hat Enterprise Linux 8.0, NetworkManager provides the following new features to VPN:

A new data chunk type, I-DATA, added to SCTP

This update adds a new data chunk type, I-DATA, and stream schedulers to the Stream Control Transmission Protocol (SCTP). Previously, SCTP sent user messages in the same order as they were sent by a user. Consequently, a large SCTP user message blocked all other messages in any stream until completely sent. When using I-DATA chunks, the Transmission Sequence Number (TSN) field is not overloaded. As a result, SCTP now can schedule the streams in different ways, and I-DATA allows user messages interleaving (RFC 8260). Note that both peers must support the I-DATA chunk type.

NetworkManager supports configuring ethtool offload features

With this enhancement, NetworkManager supports configuring ethtool offload features, and users no longer need to use init scripts or a NetworkManager dispatcher script. As a result, users can now configure the offload feature as a part of the connection profile using one of the following methods:

TCP BBR support in RHEL 8

A new TCP congestion control algorithm, Bottleneck Bandwidth and Round-trip time (BBR) is now supported in Red Hat Enterprise Linux (RHEL) 8. BBR attempts to determine the bandwidth of the bottleneck link and the Round-trip time (RTT). Most congestion algorithms are based on packet loss (including CUBIC, the default Linux TCP congestion control algorithm), which have problems on high-throughput links. BBR does not react to loss events directly, it adjusts the TCP pacing rate to match it with the available bandwidth. Users of TCP BBR should switch to the fq queueing setting on all the involved interfaces.

lksctp-tools, version 1.0.18 in RHEL 8

The lksctp-tools package, version 3.28 is available in Red Hat Enterprise Linux (RHEL) 8. Notable enhancements and bug fixes include:

Blacklisting SCTP module by default in RHEL 8

To increase security, a set of kernel modules have been moved to the kernel-modules-extra package. These are not installed by default. As a consequence, non-root users cannot load these components as they are blacklisted by default. To use one of these kernel modules, the system administrator must install kernel-modules-extra and explicitly remove the module blacklist. As a result, non-root users will be able to load the software component automatically.

Notable changes in driverctl 0.101

Red Hat Enterprise Linux 8.0 is distributed with driverctl 0.101. This version includes the following bug fixes:

Added rich rules priorities to firewalld

The priority option has been added to rich rules. This allows users to define the desirable priority order during the rule execution and provides more advanced control over rich rules.

NVMe over RDMA is supported in RHEL 8

In Red Hat Enterprise Linux (RHEL) 8, Nonvolatile Memory Express (NVMe) over Remote Direct Memory Access (RDMA) supports Infiniband, RoCEv2, and iWARP only in initiator mode.

The nf_tables back end does not support debugging using dmesg

Red Hat Enterprise Linux 8.0 uses the nf_tables back end for firewalls that does not support debugging the firewall using the output of the dmesg utility. To debug firewall rules, use the xtables-monitor -t or nft monitor trace commands to decode rule evaluation events.

Red Hat Enterprise Linux supports VRF

The kernel in RHEL 8.0 supports virtual routing and forwarding (VRF). VRF devices, combined with rules set using the ip utility, enable administrators to create VRF domains in the Linux network stack. These domains isolate the traffic on layer 3 and, therefore, the administrator can create different routing tables and reuse the same IP addresses within different VRF domains on one host.

iproute, version 4.18 in RHEL 8

The iproute package is distributed with the version 4.18 in Red Hat Enterprise Linux (RHEL) 8. The most notable change is that the interface alias marked as ethX:Y, such as eth0:1, is no longer supported. To work around this problem, users should remove the alias suffix, which is the colon and the following number before entering ip link show.

SWID tag of the RHEL 8.0 release

To enable identification of RHEL 8.0 installations using the ISO/IEC 19770-2:2015 mechanism, software identification (SWID) tags are installed in files /usr/lib/swidtag/redhat.com/com.redhat.RHEL-8-<architecture>.swidtag and /usr/lib/swidtag/redhat.com/com.redhat.RHEL-8.0-<architecture>.swidtag. The parent directory of these tags can also be found by following the /etc/swid/swidtags.d/redhat.com symbolic link.

System-wide cryptographic policies are applied by default

Crypto-policies is a component in Red Hat Enterprise Linux 8, which configures the core cryptographic subsystems, covering the TLS, IPsec, DNSSEC, Kerberos, and SSH protocols. It provides a small set of policies, which the administrator can select using the update-crypto-policies command.

OpenSSH rebased to version 7.8p1

The openssh packages have been upgraded to upstream version 7.8p1. Notable changes include:

The automatic OpenSSH server keys generation is now handled by sshd-keygen@.service

OpenSSH creates RSA, ECDSA, and ED25519 server host keys automatically if they are missing. To configure the host key creation in RHEL 8, use the sshd-keygen@.service instantiated service.

ECDSA keys are supported for SSH authentication

This release of the OpenSSH suite introduces support for ECDSA keys stored on PKCS #11 smart cards. As a result, users can now use both RSA and ECDSA keys for SSH authentication.

libssh implements SSH as a core cryptographic component

This change introduces libssh as a core cryptographic component in Red Hat Enterprise Linux 8. The libssh library implements the Secure Shell (SSH) protocol.

TLS 1.3 support in cryptographic libraries

This update enables Transport Layer Security (TLS) 1.3 by default in all major back-end crypto libraries. This enables low latency across the operating system communications layer and enhances privacy and security for applications by taking advantage of new algorithms, such as RSA-PSS or X25519.

NSS now use SQL by default

The Network Security Services (NSS) libraries now use the SQL file format for the trust database by default. The DBM file format, which was used as a default database format in previous releases, does not support concurrent access to the same database by multiple processes and it has been deprecated in upstream. As a result, applications that use the NSS trust database to store keys, certificates, and revocation information now create databases in the SQL format by default. Attempts to create databases in the legacy DBM format fail. The existing DBM databases are opened in read-only mode, and they are automatically converted to the SQL format. Note that NSS support the SQL file format since Red Hat Enterprise Linux 6.

PKCS #11 support for smart cards and HSMs is now consistent across the system

With this update, using smart cards and Hardware Security Modules (HSM) with PKCS #11 cryptographic token interface becomes consistent. This means that the user and the administrator can use the same syntax for all related tools in the system. Notable enhancements include:

Firefox now works with system-wide registered PKCS #11 drivers

The Firefox web browser automatically loads the p11-kit-proxy module and every smart card that is registered system-wide in p11-kit through the pkcs11.conf file is automatically detected. For using TLS client authentication, no additional setup is required and keys from a smart card are automatically used when a server requests them.

RSA-PSS is now supported in OpenSC

This update adds support for the RSA-PSS cryptographic signature scheme to the OpenSC smart card driver. The new scheme enables a secure cryptographic algorithm required for the TLS 1.3 support in the client software.

Notable changes in Libreswan in RHEL 8

The libreswan packages have been upgraded to upstream version 3.27, which provides many bug fixes and enhancements over the previous versions. Most notable changes include:

System-wide cryptographic policies change the default IKE version in Libreswan to IKEv2

The default IKE version in the Libreswan IPsec implementation has been changed from IKEv1 (RFC 2409) to IKEv2 (RFC 7296). The default IKE and ESP/AH algorithms for use with IPsec have been updated to comply with system-wide crypto policies, RFC 8221, and RFC 8247. Encryption key sizes of 256 bits are now preferred over key sizes of 128 bits.

IKE version-related changes in Libreswan

With this enhancement, Libreswan handles internet key exchange (IKE) settings differently:

New features in OpenSCAP in RHEL 8

The OpenSCAP suite has been upgraded to upstream version 1.3.0, which introduces many enhancements over the previous versions. The most notable features include:

SCAP Security Guide now supports system-wide cryptographic policies

The scap-security-guide packages have been updated to use predefined system-wide cryptographic policies for configuring the core cryptographic subsystems. The security content that conflicted with or overrode the system-wide cryptographic policies has been removed.

OpenSCAP command-line interface has been improved

The verbose mode is now available in all oscap modules and submodules. The tool output has improved formatting.

SCAP Security Guide PCI-DSS profile aligns with version 3.2.1

The scap-security-guide packages provide the PCI-DSS (Payment Card Industry Data Security Standard) profile for Red Hat Enterprise Linux 8 and this profile has been updated to align with the latest PCI-DSS version - 3.2.1.

SCAP Security Guide supports OSPP 4.2

The scap-security-guide packages provide a draft of the OSPP (Protection Profile for General Purpose Operating Systems) profile version 4.2 for Red Hat Enterprise Linux 8. This profile reflects mandatory configuration controls identified in the NIAP Configuration Annex to the Protection Profile for General Purpose Operating Systems (Protection Profile Version 4.2). SCAP Security Guide provides automated checks and scripts that help users to meet requirements defined in the OSPP.

Notable changes in rsyslog in RHEL 8

The rsyslog packages have been upgraded to upstream version 8.37.0, which provides many bug fixes and enhancements over the previous versions. Most notable changes include:

New rsyslog module: omkafka

To enable kafka centralized data storage scenarios, you can now forward logs to the kafka infrastructure using the new omkafka module.

rsyslog imfile now supports symlinks

With this update, the rsyslog imfile module delivers better performance and more configuration options. This allows you to use the module for more complicated file monitoring use cases. For example, you can now use file monitors with glob patterns anywhere along the configured path and rotate symlink targets with increased data throughput.

The default rsyslog configuration file format is now non-legacy

The configuration files in the rsyslog packages now use the non-legacy format by default. The legacy format can be still used, however, mixing current and legacy configuration statements has several constraints. Configurations carried from previous RHEL releases should be revised. See the rsyslog.conf(5) man page for more information.

Audit 3.0 replaces audispd with auditd

With this update, functionality of audispd has been moved to auditd. As a result, audispd configuration options are now part of auditd.conf. In addition, the plugins.d directory has been moved under /etc/audit. The current status of auditd and its plug-ins can now be checked by running the service auditd state command.

tangd_port_t allows changes of the default port for Tang

This update introduces the tangd_port_t SELinux type that allows the tangd service run as confined with SELinux enforcing mode. That change helps to simplify configuring a Tang server to listen on a user-defined port and it also preserves the security level provided by SELinux in enforcing mode.

New SELinux booleans

This update of the SELinux system policy introduces the following booleans:

SELinux now supports systemd No New Privileges

This update introduces the nnp_nosuid_transition policy capability that enables SELinux domain transitions under No New Privileges (NNP) or nosuid if nnp_nosuid_transition is allowed between the old and new contexts. The selinux-policy packages now contain a policy for systemd services that use the NNP security feature.

Support for a new map permission check on the mmap syscall

The SELinux map permission has been added to control memory mapped access to files, directories, sockets, and so on. This allows the SELinux policy to prevent direct memory access to various file system objects and ensure that every such access is revalidated.

SELinux now supports getrlimit permission in the process class

This update introduces a new SELinux access control check, process:getrlimit, which has been added for the prlimit() function. This enables SELinux policy developers to control when one process attempts to read and then modify the resource limits of another process using the process:setrlimit permission. Note that SELinux does not restrict a process from manipulating its own resource limits through prlimit(). See the prlimit(2) and getrlimit(2) man pages for more information.

selinux-policy now supports VxFS labels

This update introduces support for Veritas File System (VxFS) security extended attributes (xattrs). This enables to store proper SELinux labels with objects on the file system instead of the generic vxfs_t type. As a result, systems with VxFS with full support for SELinux are more secure.

Compile-time security hardening flags are applied more consistently

Compile-time security hardening flags are applied more consistently on RPM packages in the RHEL 8 distribution, and the redhat-rpm-config package now automatically provides security hardening flags. The applied compile-time flags also help to meet Common Criteria (CC) requirements. The following security hardening flags are applied:

qemu-kvm 2.12 in RHEL 8

Red Hat Enterprise Linux 8 is distributed with qemu-kvm 2.12. This version fixes multiple bugs and adds a number of enhancements over the version 1.5.3, available in Red Hat Enterprise Linux 7.

The Q35 machine type is now supported by virtualization

Red hat Enterprise Linux 8 introduces the support for Q35, a more modern PCI Express-based machine type. This provides a variety of improvements in features and performance of virtual devices, and ensures that a wider range of modern devices are compatible with virtualization. In addition, virtual machines created in Red Hat Enterprise Linux 8 are set to use Q35 by default.

Post-copy virtual machine migration

RHEL 8 makes it possible to perform a post-copy migration of KVM virtual machines (VMs). When used, post-copy migration pauses the migrating VM’s vCPUs on the source host, transfers only a minimum of memory pages, activates the VM’s vCPUs on the destination host, and transfers the remaining memory pages while the VM is running on the destination.

virtio-gpu is now supported by KVM virtualization

The virtio-gpu display device has been introduced for KVM virtual machines (VMs). virtio-gpu improves VM graphical performance and also enables various enhancements for virtual GPU devices to be implemented in the future.

KVM supports UMIP in RHEL 8

KVM virtualization now supports the User-Mode Instruction Prevention (UMIP) feature, which can help prevent user-space applications from accessing to system-wide settings. This reduces the potential vectors for privilege escalation attacks, and thus makes the KVM hypervisor and its guest machines more secure.

Additional information in KVM guest crash reports

The crash information that KVM hypervisor generates if a guest terminates unexpectedly or becomes unresponsive has been expanded. This makes it easier to diagnose and fix problems in KVM virtualization deployments.

NVIDIA vGPU is now compatible with the VNC console

When using the NVIDIA virtual GPU (vGPU) feature, it is now possible to use the VNC console to display the visual output of the guest.

Ceph is supported by virtualization

With this update, Ceph storage is supported by KVM virtualization on all CPU architectures supported by Red Hat.

Interactive boot loader for KVM virtual machines on IBM Z

When booting a KVM virtual machine on an IBM Z host, the QEMU boot loader firmware can now present an interactive console interface of the guest OS. This makes it possible to troubleshoot guest OS boot problems without access to the host environment.

IBM z14 ZR1 supported in virtual machines

The KVM hypervisor now supports the CPU model of the IBM z14 ZR1 server. This enables using the features of this CPU in KVM virtual machines that run on an IBM Z system.

KVM supports Telnet 3270 on IBM Z

When using RHEL 8 as a host on an IBM Z system, it is now possible to connect to virtual machines on the host using Telnet 3270 clients.

QEMU sandboxing has been added

In Red Hat Enterprise Linux 8, the QEMU emulator introduces the sandboxing feature. QEMU sandboxing provides configurable limitations to what systems calls QEMU can perform, and thus makes virtual machines more secure. Note that this feature is enabled and configured by default.

PV TLB Flush Hyper-V enlightenment

RHEL 8 adds the PV TLB Flush Hyper-V Enlightenment feature. This improves the performance of Windows virtual machines (VMs) that run in overcommitted environments on the KVM hypervisor.

New machine types for KVM virtual machines on IBM POWER

Multiple new rhel-pseries machine types have been enabled for KVM hypervisors running on IBM POWER 8 and IBM POWER 9 systems. This makes it possible for virtual machines (VMs) hosted on RHEL 8 on an IBM POWER system to correctly use the CPU features of these machine types. In addition, this allows for migrating VMs on IBM POWER to a more recent version of the KVM hypervisor.

GFNI and CLDEMOT instruction sets enabled for Intel Xeon SnowRidge

Virtual machines (VMs) running in a RHEL 8 host on an Intel Xeon SnowRidge system are now able to use the GFNI and CLDEMOT instruction sets. This may significantly increase the performance of such VMs in certain scenarios.

IPv6 enabled for OVMF

The IPv6 protocol is now enabled on Open Virtual Machine Firmware (OVMF). This makes it possible for virtual machines that use OVMF to take advantage of a variety of network boot improvements that IPv6 provides.

A VFIO-based block driver for NVMe devices has been added

The QEMU emulator introduces a driver based on virtual function I/O (VFIO) for Non-volatile Memory Express (NVMe) devices. The driver communicates directly with NVMe devices attached to virtual machines (VMs) and avoids using the kernel system layer and its NVMe drivers. As a result, this enhances the performance of NVMe devices in virtual machines.

Multichannel support for the Hyper-V Generic UIO driver

RHEL 8 now supports the multichannel feature for the Hyper-V Generic userspace I/O (UIO) driver. This makes it possible for RHEL 8 VMs running on the Hyper-V hypervisor to use the Data Plane Development Kit (DPDK) Netvsc Poll Mode driver (PMD), which enhances the networking capabilities of these VMs.

Improved huge page support

When using RHEL 8 as a virtualization host, users can modify the size of pages that back memory of a virtual machine (VM) to any size that is supported by the CPU. This can significantly improve the performance of the VM.

VMs on POWER 9 hosts can use THP

In RHEL 8 hosts running on the IBM POWER 9 architecture, virtual machines (VMs) benefit from the transparent huge pages (THP) feature. THP enables the host kernel to dynamically assign huge memory pages to processes and thus improves the performance of VMs with large amounts of memory.

sosreport can report eBPF-based programs and maps

The sosreport tool has been enhanced to report any loaded extended Berkeley Packet Filtering (eBPF) programs and maps in Red Hat Enterprise Linux 8.

PackageKit can now operate on rpm packages

With this update, the support for operating on rpm packages has been added into PackageKit.

QEMU does not handle 8-byte ggtt entries correctly

QEMU occasionally splits an 8-byte ggtt entry write to two consecutive 4-byte writes. Each of these partial writes can trigger a separate host ggtt write. Sometimes the two ggtt writes are combined incorrectly. Consequently, translation to a machine address fails, and an error log occurs.

The Enterprise Security Client uses the opensc library for token detection

Red Hat Enterprise Linux 8.0 only supports the opensc library for smart cards. With this update, the Enterprise Security Client (ESC) use opensc for token detection instead of the removed coolkey library. As a result, applications correctly detect supported tokens.

Certificate System now supports rotating debug logs

Previously, Certificate System used a custom logging framework, which did not support log rotation. As a consequence, debug logs such as /var/log/pki/instance_name/ca/debug grew indefinitely. With this update, Certificate System uses the java.logging.util framework, which supports log rotation. As a result, you can configure log rotation in the /var/lib/pki/instance_name/conf/logging.properties file.

Certificate System no longer logs SetAllPropertiesRule operation warnings when the service starts

Previously, Certificate System logged warnings on the SetAllPropertiesRule operation in the /var/log/messages log file when the service started. The problem has been fixed, and the mentioned warnings are no longer logged.

The Certificate System KRA client parses Key Request responses correctly

Previously, Certificate System switched to a new JSON library. As a consequence, serialization for certain objects differed, and the Python key recovery authority (KRA) client failed to parse Key Request responses. The client has been modified to support responses using both the old and the new JSON library. As a result, the Python KRA client parses Key Request responses correctly.

GCC no longer produces false positive warnings about out-of-bounds access

Previously, when compiling with the -O3 optimization level option, the GNU Compiler Collection (GCC) occasionally returned a false positive warning about an out-of-bounds access, even if the compiled code did not contain it. The optimization has been fixed and GCC no longer displays the false positive warning.

ltrace displays large structures correctly

Previously, the ltrace tool could not correctly print large structures returned from functions. Handling of large structures in ltrace has been improved and they are now printed correctly.

GCC built-in function __builtin_clz returns correct values on IBM Z

Previously, the FLOGR instruction of the IBM Z architecture was incorrectly folded by the GCC compiler. As a consequence, the __builtin_clz function using this instruction could return wrong results when the code was compiled with the -funroll-loops GCC option. This bug has been fixed and the function now provides correct results.

GDB provides nonzero exit status when last command in batch mode fails

Previously, GDB always exited with status 0 when running in batch mode, regardless of errors in the commands. As a consequence, it was not possible to determine whether the commands succeeded. This behavior has been changed and GDB now exits with status 1 when an error occurs in the last command. This preserves compatibility with the previous behavior where all commands are executed. As a result, it is now possible to determine if GDB batch mode execution is successful.

Higher print levels no longer cause iscsiadm to terminate unexpectedly

Previously, the iscsiadm utility terminated unexpectedly when the user specified a print level higher than 0 with the --print or -P option. This problem has been fixed, and all print levels now work as expected.

multipathd no longer disables the path when it fails to get the WWID of a path

Previously, the multipathd service treated a failed attempt at getting a path’s WWID as getting an empty WWID. If multipathd failed to get the WWID of a path, it sometimes disabled that path.

New /etc/sysconfig/pcsd option to reject client-initiated SSL/TLS renegotiation

When TLS renegotiation is enabled on the server, a client is allowed to send a renegotiation request, which initiates a new handshake. Computational requirements of a handshake are higher on a server than on a client. This makes the server vulnerable to DoS attacks. With this fix, the setting PCSD_SSL_OPTIONS in the /etc/sysconfig/pcsd configuration file accepts the OP_NO_RENEGOTIATION option to reject renegotiations. Note that the client can still open multiple connections to a server with a handshake performed in all of them.

A removed cluster node is no longer displayed in the cluster status

Previously, when a node was removed with the pcs cluster node remove command, the removed node remained visible in the output of a pcs status display. With this fix, the removed node is no longer displayed in the cluster status.

Fence agents can now be configured using either newer, preferred parameter names or deprecated parameter names

A large number of fence agent parameters have been renamed while the old parameter names are still supported as deprecated. Previously, pcs was not able to set the new parameters unless used with the --force option. With this fix, pcs now supports the renamed fence agent parameters while maintaining support for the deprecated parameters.

The pcs command now correctly reads the XML status of a cluster for display

The pcs command runs the crm_mon utility to get the status of a cluster in XML format. The crm_mon utility prints XML to standard output and warnings to standard error output. Previously pcs mixed XML and warnings into one stream and was then unable to parse it as XML. With this fix, standard and error outputs are separated in pcs and reading the XML status of a cluster works as expected.

Users no longer advised to destroy clusters when creating new clusters with nodes from existing clusters

Previously, when a user specified nodes from an existing cluster when running the pcs cluster setup command or when creating a cluster with the pcsd Web UI, pcs reported that as an error and suggested that the user destroy the cluster on the nodes. As a result, users would destroy the cluster on the nodes, breaking the cluster the nodes were part of as the remaining nodes would still consider the destroyed nodes to be part of the cluster. With this fix, users are instead advised to remove nodes from their cluster, better informing them of how to address the issue without breaking their clusters.

pcs commands no longer interactively ask for credentials

When a non-root user runs a pcs command that requires root permission, pcs connects to the locally running pcsd daemon and passes the command to it, since the pcsd daemon runs with root permissions and is capable of running the command. Previously, if the user was not authenticated to the local pcsd daemon, pcs asked for a user name and a password interactively. This was confusing to the user and required special handling in scripts running pcs. With this fix, if the user is not authenticated then pcs exits with an error advising what to do: Either run pcs as root or authenticate using the new pcs client local-auth command. As a result, pcs commands do not interactively ask for credentials, improving the user experience.

The pcsd daemon now starts with its default self-generated SSL certificate when crypto-policies is set to FUTURE.

A crypto-policies setting of FUTURE requires RSA keys in SSL certificates to be at least 3072b long. Previously, the pcsd daemon would not start when this policy was set since it generates SSL certificates with a 2048b key. With this update, the key size of pcsd self-generated SSL certificates has been increased to 3072b and pcsd now starts with its default self-generated SSL certificate.

The pcsd service now starts when the network is ready

Previously, When a user configured pcsd to bind to a specific IP address and the address was not ready during boot when pcsd attempted to start up, then pcsd failed to start and a manual intervention was required to start pcsd. With this fix, pcsd.service depends on network-online.target. As a result, pcsd starts when the network is ready and is able to bind to an IP address.

Weak TLS algorithms are no longer allowed for glib-networking

Previously, the glib-networking package was not compatible with RHEL 8 System-wide Crypto Policy. As a consequence, applications using the glib library for networking might allow Transport Layer Security (TLS) connections using weak algorithms than the administrator intended. With this update, the system-wide crypto policy is applied, and now applications using glib for networking allow only TLS connections that are acceptable according to the policy.

SELinux policy now allows iscsiuio processes to connect to the discovery portal

Previously, SELinux policy was too restrictive for iscsiuio processes and these processes were not able to access /dev/uio* devices using the mmap system call. As a consequence, connection to the discovery portal failed. This update adds the missing rules to the SELinux policy and iscsiuio processes work as expected in the described scenario.

dnf and yum can now access the repos regardless of subscription-manager values

Previously, the dnf or yum commands ignored the https:// prefix from a URL added by the subscription-manager service. The updated dnf or yum commands do not ignore invalid https:// URLs. As a consequence, dnf and yum failed to access the repos. To fix the problem, a new configuration variable, proxy_scheme has been added to the /etc/rhsm/rhsm.conf file and the value can be set to either http or https. If no value is specified, subscription-manager set http by default which is more commonly used.

Mounting ephemeral disks on Azure now works more reliably

Previously, mounting an ephemeral disk on a virtual machine (VM) running on the Microsoft Azure platform failed if the VM was "stopped(deallocated)" and then started. This update ensures that reconnecting disks is handled correctly in the described circumstances, which prevents the problem from occurring.

eBPF available as a Technology Preview

The extended Berkeley Packet Filtering (eBPF) feature is available as a Technology Preview for both networking and tracing. eBPF enables the user space to attach custom programs onto a variety of points (sockets, trace points, packet reception) to receive and process data. The feature includes a new system call bpf(), which supports creating various types of maps, and also to insert various types of programs into the kernel. Note that the bpf() syscall can be successfully used only by a user with the CAP_SYS_ADMIN capability, such as a root user. See the bpf(2) man page for more information.

BCC is available as a Technology Preview

BPF Compiler Collection (BCC) is a user space tool kit for creating efficient kernel tracing and manipulation programs that is available as a Technology Preview in Red Hat Enterprise Linux 8. BCC provides tools for I/O analysis, networking, and monitoring of Linux operating systems using the extended Berkeley Packet Filtering (eBPF).

Control Group v2 available as a Technology Preview in RHEL 8

Control Group v2 mechanism is a unified hierarchy control group. Control Group v2 organizes processes hierarchically and distributes system resources along the hierarchy in a controlled and configurable manner.

early kdump available as a Technology Preview in Red Hat Enterprise Linux 8

The early kdump feature allows the crash kernel and initramfs to load early enough to capture the vmcore information even for early crashes. For more details about early kdump, see the /usr/share/doc/kexec-tools/early-kdump-howto.txt file.

The ibmvnic device driver available as a Technology Preview

With Red Hat Enterprise Linux 8.0, the IBM Virtual Network Interface Controller (vNIC) driver for IBM POWER architectures, ibmvnic, is available as a Technology Preview. vNIC is a PowerVM virtual networking technology that delivers enterprise capabilities and simplifies network management. It is a high-performance, efficient technology that when combined with SR-IOV NIC provides bandwidth control Quality of Service (QoS) capabilities at the virtual NIC level. vNIC significantly reduces virtualization overhead, resulting in lower latencies and fewer server resources, including CPU and memory, required for network virtualization.

Soft-RoCE available as a Technology Preview

Remote Direct Memory Access (RDMA) over Converged Ethernet (RoCE) is a network protocol which implements RDMA over Ethernet. Soft-RoCE is the software implementation of RoCE which supports two protocol versions, RoCE v1 and RoCE v2. The Soft-RoCE driver, rdma_rxe, is available as an unsupported Technology Preview in RHEL 8.

VNC remote console available as a Technology Preview for the 64-bit ARM architecture

On the 64-bit ARM architecture, the Virtual Network Computing (VNC) remote console is available as a Technology Preview. Note that the rest of the graphics stack is currently unverified for the 64-bit ARM architecture.

The cluster-aware MD RAID1 is available as a technology preview.

RAID1 cluster is not enabled by default in the kernel space. If you want to have a try with RAID1 cluster, you need to build the kernel with RAID1 cluster as a module first, use the following steps:

DNSSEC available as Technology Preview in IdM

Identity Management (IdM) servers with integrated DNS now support DNS Security Extensions (DNSSEC), a set of extensions to DNS that enhance security of the DNS protocol. DNS zones hosted on IdM servers can be automatically signed using DNSSEC. The cryptographic keys are automatically generated and rotated.

Identity Management JSON-RPC API available as Technology Preview

An API is available for Identity Management (IdM). To view the API, IdM also provides an API browser as Technology Preview.

Aero adapters available as a Technology Preview

The following Aero adapters are available as a Technology Preview:

Stratis is now available

Stratis is a new local storage manager. It provides managed file systems on top of pools of storage with additional features to the user.

OverlayFS

OverlayFS is a type of union file system. It enables you to overlay one file system on top of another. Changes are recorded in the upper file system, while the lower file system remains unmodified. This allows multiple users to share a file-system image, such as a container or a DVD-ROM, where the base image is on read-only media.

File system DAX is now available for ext4 and XFS as a Technology Preview

In Red Hat Enterprise Linux 8.0, file system DAX is available as a Technology Preview. DAX provides a means for an application to directly map persistent memory into its address space. To use DAX, a system must have some form of persistent memory available, usually in the form of one or more Non-Volatile Dual In-line Memory Modules (NVDIMMs), and a file system that supports DAX must be created on the NVDIMM(s). Also, the file system must be mounted with the dax mount option. Then, an mmap of a file on the dax-mounted file system results in a direct mapping of storage into the application’s address space.

Pacemaker podman bundles available as a Technology Preview

Pacemaker container bundles now run on the podman container platform, with the container bundle feature being available as a Technology Preview. There is one exception to this feature being Technology Preview: Red Hat fully supports the use of Pacemaker bundles for Red Hat Openstack.

XDP available as a Technology Preview

The eXpress Data Path (XDP) feature, which is available as a Technology Preview, provides a means to attach extended Berkeley Packet Filter (eBPF) programs for high-performance packet processing at an early point in the kernel ingress data path, allowing efficient programmable packet analysis, filtering, and manipulation.

eBPF for tc available as a Technology Preview

As a Technology Preview, the Traffic Control (tc) kernel subsystem and the tc tool can attach extended Berkeley Packet Filtering (eBPF) programs as packet classifiers and actions for both ingress and egress queueing disciplines. This enables programmable packet processing inside the kernel network data path.

AF_XDP available as a Technology Preview

Address Family eXpress Data Path (AF_XDP) socket is designed for high-performance packet processing. It accompanies XDP and grants efficient redirection of programmatically selected packets to user space applications for further processing.

KTLS available as a Technology Preview

In Red Hat Enterprise Linux 8, Kernel Transport Layer Security (KTLS) is provided as a Technology Preview. KTLS handles TLS records using the symmetric encryption or decryption algorithms in the kernel for the AES-GCM cipher. KTLS also provides the interface for offloading TLS record encryption to Network Interface Controllers (NICs) that support this functionality.

TIPC available as a Technology Preview

The Transparent Inter Process Communication (TIPC) is a protocol specially designed for efficient communication within clusters of loosely paired nodes. It works as a kernel module and provides a tipc tool in iproute2 package to allow designers to create applications that can communicate quickly and reliably with other applications regardless of their location within the cluster. This feature is available as a Technology Preview.

The systemd-resolved service is now available as a Technology Preview

The systemd-resolved service provides name resolution to local applications. The service implements a caching and validating DNS stub resolver, an Link-Local Multicast Name Resolution (LLMNR), and Multicast DNS resolver and responder.

The postfix role of RHEL system roles available as a Technology Preview

Red Hat Enterprise Linux system roles provides a configuration interface for Red Hat Enterprise Linux subsystems, which makes system configuration easier through the inclusion of Ansible Roles. This interface enables managing system configurations across multiple versions of Red Hat Enterprise Linux, as well as adopting new major releases.

AMD SEV for KVM virtual machines

As a Technology Preview, RHEL 8 introduces the Secure Encrypted Virtualization (SEV) feature for AMD EPYC host machines that use the KVM hypervisor. If enabled on a virtual machine (VM), SEV encrypts VM memory so that the host cannot access data on the VM. This increases the security of the VM if the host is successfully infected by malware.

Intel vGPU

As a Technology Preview, it is now possible to divide a physical Intel GPU device into multiple virtual devices referred to as mediated devices. These mediated devices can then be assigned to multiple virtual machines (VMs) as virtual GPUs. As a result, these VMs share the performance of a single physical Intel GPU.

Nested virtualization now available on IBM POWER 9

As a Technology Preview, it is now possible to use the nested virtualization features on RHEL 8 host machines running on IBM POWER 9 systems. Nested virtualization enables KVM virtual machines (VMs) to act as hypervisors, which allows for running VMs inside VMs.

KVM virtualization is usable in RHEL 8 Hyper-V virtual machines

As a Technology Preview, nested KVM virtualization can now be used on the Microsoft Hyper-V hypervisor. As a result, you can create virtual machines on a RHEL 8 guest system running on a Hyper-V host.

The podman-machine command is unsupported

The podman-machine command for managing virtual machines, is available only as a Technology Preview. Instead, run Podman directly from the command line.

The --interactive option of the ignoredisk Kickstart command has been deprecated

Using the --interactive option in future releases of Red Hat Enterprise Linux will result in a fatal installation error. It is recommended that you modify your Kickstart file to remove the option.

Several Kickstart commands and options have been deprecated

Using the following commands and options in RHEL 8 Kickstart files will print a warning in the logs.

NFSv3 over UDP has been disabled

The NFS server no longer opens or listens on a User Datagram Protocol (UDP) socket by default. This change affects only NFS version 3 because version 4 requires the Transmission Control Protocol (TCP).

The elevator kernel command line parameter is deprecated

The elevator kernel command line parameter was used in earlier RHEL releases to set the disk scheduler for all devices. In RHEL 8, the parameter is deprecated.

The VDO Ansible module in VDO packages

The VDO Ansible module is currently provided by the vdo RPM package. In a future release, the VDO Ansible module will be moved to the Ansible RPM packages.

Network scripts are deprecated in RHEL 8

Network scripts are deprecated in Red Hat Enterprise Linux 8 and they are no longer provided by default. The basic installation provides a new version of the ifup and ifdown scripts which call the NetworkManager service through the nmcli tool. In Red Hat Enterprise Linux 8, to run the ifup and the ifdown scripts, NetworkManager must be running.

The rdma_rxe Soft-RoCE driver is deprecated

Software Remote Direct Memory Access over Converged Ethernet (Soft-RoCE), also known as RXE, is a feature that emulates Remote Direct Memory Access (RDMA). In RHEL 8, the Soft-RoCE feature is available as an unsupported Technology Preview. However, due to stability issues, this feature has been deprecated and will be removed in RHEL 9.

DSA is deprecated in RHEL 8

The Digital Signature Algorithm (DSA) is considered deprecated in Red Hat Enterprise Linux 8. Authentication mechanisms that depend on DSA keys do not work in the default configuration. Note that OpenSSH clients do not accept DSA host keys even in the LEGACY system-wide cryptographic policy level.

SSL2 Client Hello has been deprecated in NSS

The Transport Layer Security (TLS) protocol version 1.2 and earlier allow to start a negotiation with a Client Hello message formatted in a way that is backward compatible with the Secure Sockets Layer (SSL) protocol version 2. Support for this feature in the Network Security Services (NSS) library has been deprecated and it is disabled by default.

TLS 1.0 and TLS 1.1 are deprecated

The TLS 1.0 and TLS 1.1 protocols are disabled in the DEFAULT system-wide cryptographic policy level. If your scenario, for example, a video conferencing application in the Firefox web browser, requires using the deprecated protocols, switch the system-wide cryptographic policy to the LEGACY level:

Virtual machine snapshots are not properly supported in RHEL 8

The current mechanism of creating virtual machine (VM) snapshots has been deprecated, as it is not working reliably. As a consequence, it is recommended not to use VM snapshots in RHEL 8.

The Cirrus VGA virtual GPU type has been deprecated

With a future major update of Red Hat Enterprise Linux, the Cirrus VGA GPU device will no longer be supported in KVM virtual machines. Therefore, Red Hat recommends using the stdvga, virtio-vga, or qxl devices instead of Cirrus VGA.

virt-manager has been deprecated

The Virtual Machine Manager application, also known as virt-manager, has been deprecated. The RHEL 8 web console, also known as Cockpit, is intended to become its replacement in a subsequent release. It is, therefore, recommended that you use the web console for managing virtualization in a GUI. However, in Red Hat Enterprise Linux 8.0, some features may only be accessible from either virt-manager or the command line.

Logging to RHEL web console with session_recording shell is not possible

Currently, the RHEL web console logins will fail for tlog recording-enabled users. RHEL web console requires a user’s shell to be present in the /etc/shells directory to allow a successful login. However, if tlog-rec-session is added to /etc/shells, a recorded user is able to disable recording by changing the shell from tlog-rec-session to another shell from /etc/shells, using the "chsh" utility. Red Hat does not recommend adding tlog-rec-session to /etc/shells for this reason.

The auth and authconfig Kickstart commands require the AppStream repository

The authselect-compat package is required by the auth and authconfig Kickstart commands during installation. Without this package, the installation fails if auth or authconfig are used. However, by design, the authselect-compat package is only available in the AppStream repository.

The xorg-x11-drv-fbdev, xorg-x11-drv-vesa, and xorg-x11-drv-vmware video drivers are not installed by default

Workstations with specific models of NVIDIA graphics cards and workstations with specific AMD accelerated processing units will not display the graphical login window after a RHEL 8.0 Server installation.

Installation fails when using the reboot --kexec command

The RHEL 8 installation fails when using a Kickstart file that contains the reboot --kexec command. To avoid the problem, use the reboot command instead of reboot --kexec in your Kickstart file.

Copying the content of the Binary DVD.iso file to a partition omits the .treeinfo and .discinfo files

During local installation, while copying the content of the RHEL 8 Binary DVD.iso image file to a partition, the * in the cp <path>/\* <mounted partition>/dir command fails to copy the .treeinfo and .discinfo files. These files are required for a successful installation. As a result, the BaseOS and AppStream repositories are not loaded, and a debug-related log message in the anaconda.log file is the only record of the problem.

Anaconda installation includes low limits of minimal resources setting requirements

Anaconda initiates the installation on systems with minimal resource settings required available and do not provide previous message warning about the required resources for performing the installation successfully. As a result, the installation can fail and the output errors do not provide clear messages for possible debug and recovery. To work around this problem, make sure that the system has the minimal resources settings required for installation: 2GB memory on PPC64(LE) and 1GB on x86_64. As a result, it should be possible to perform a successful installation.

The reboot --kexec and inst.kexec commands do not provide a predictable system state

Performing a RHEL installation with the reboot --kexec Kickstart command or the inst.kexec kernel boot parameters do not provide the same predictable system state as a full reboot. As a consequence, switching to the installed system without rebooting can produce unpredictable results.

The i40iw module does not load automatically on boot

Due to many i40e NICs not supporting iWarp and the i40iw module not fully supporting suspend/resume, this module is not automatically loaded by default to ensure suspend/resume works properly. To work around this problem, manually edit the /lib/udev/rules.d/90-rdma-hw-modules.rules file to enable automated load of i40iw.

The system sometimes becomes unresponsive when many devices are connected

When Red Hat Enterprise Linux 8 configures a large number of devices, a large number of console messages occurs on the system console. This happens, for example, when there are a large number of logical unit numbers (LUNs), with multiple paths to each LUN. The flood of console messages, in addition to other work the kernel is doing, might cause the kernel watchdog to force a kernel panic because the kernel appears to be hung.

KSM sometimes ignores NUMA memory policies

When the kernel shared memory (KSM) feature is enabled with the merge_across_nodes=1 parameter, KSM ignores memory policies set by the mbind() function, and may merge pages from some memory areas to Non-Uniform Memory Access (NUMA) nodes that do not match the policies.

The qede driver hangs the NIC and makes it unusable

Due to a bug, the qede driver for the 41000 and 45000 QLogic series NICs can cause Firmware upgrade and debug data collection operations to fail and make the NIC unusable or in hung state until reboot (PCI reset) of the host makes the NIC operational again.

Radix tree symbols were added to kernel-abi-whitelists

The following radix tree symbols have been added to the kernel-abi-whitelists package in Red Hat Enterprise Linux 8:

podman fails to checkpoint a container in RHEL 8

The version of the Checkpoint and Restore In Userspace (CRIU) package is outdated in Red Hat Enterprise Linux 8. As a consequence, CRIU does not support container checkpoint and restore functionality and the podman utility fails to checkpoint containers. When running the podman container checkpoint command, the following error message is displayed: 'checkpointing a container requires at least CRIU 31100'

early-kdump and standard kdump fail if the add_dracutmodules+=earlykdump option is used in dracut.conf

Currently, an inconsistency occurs between the kernel version being installed for early-kdump and the kernel version initramfs is generated for. As a consequence, booting with early-kdump enabled, early-kdump fails. In addition, if early-kdump detects that it is being included in a standard kdump initramfs image, it forces an exit. Therefore the standard kdump service also fails when trying to rebuild kdump initramfs if early-kdump is added as a default dracut module. As a consequence, early-kdump and standard kdump both fail. To work around this problem, do not add add_dracutmodules+=earlykdump or any equivalent configuration in the dracut.conf file. As a result, early-kdump is not included by dracut by default, which prevents the problem from occuring. However, if an early-kdump image is required, it has to be created manually.

Debug kernel fails to boot in crash capture environment in RHEL 8

Due to memory-demanding nature of the debug kernel, a problem occurs when the debug kernel is in use and a kernel panic is triggered. As a consequence, the debug kernel is not able to boot as the capture kernel, and a stack trace is generated instead. To work around this problem, increase the crash kernel memory accordingly. As a result, the debug kernel successfully boots in the crash capture environment.

Network interface is renamed to kdump-<interface-name> when fadump is used

When firmware-assisted dump (fadump) is utilized to capture a vmcore and store it to a remote machine using SSH or NFS protocol, the network interface is renamed to kdump-<interface-name> if <interface-name> is generic, for example, *eth#, or net#. This problem occurs because the vmcore capture scripts in the initial RAM disk (initrd) add the kdump- prefix to the network interface name to secure persistent naming. The same initrd is used also for a regular boot, so the interface name is changed for the production kernel too.

Running yum list under a non-root user causes YUM crash

When running the yum list command under a non-root user after the libdnf package has been updated, YUM can terminate unexpectedly. If you hit this bug, run yum list under root to resolve the problem. As a result, subsequent attempts to run yum list under a non-root user no longer cause YUM crash.

YUM v4 skips unavailable repositories by default

YUM v4 defaults to the "skip_if_unavailable=True" setting for all repositories. As a consequence, if the required repository is not available, the packages from the repository are not considered in the install, search, or update operations. Subsequently, some yum commands and yum-based scripts succeed with exit code 0 even if there are unavailable repositories.

The nslookup and host utilities ignore replies from name servers with recursion not available

If more name servers are configured and recursion is not available for a name server, the nslookup and host utilities ignore replies from such name server unless it is the one that is last configured. In case of the last configured name server, answer is accepted even without the recursion available flag. However, if the last configured name server is not responding or unreachable, name resolution fails.

Python binding of the net-snmp package is unavailable

The Net-SNMP suite of tools does not provide binding for Python 3, which is the default Python implementation in RHEL 8. Consequently, python-net-snmp, python2-net-snmp, or python3-net-snmp packages are unavailable in RHEL 8.

systemd in debug mode produces unnecessary log messages

The systemd system and service manager in debug mode produces unnecessary log messages that start with:

ksh with the KEYBD trap mishandles multibyte characters

The Korn Shell (KSH) is unable to correctly handle multibyte characters when the KEYBD trap is enabled. Consequently, when the user enters, for example, Japanese characters, ksh displays an incorrect string. To work around this problem, disable the KEYBD trap in the /etc/kshrc file by commenting out the following line:

Database servers are not installable in parallel

The mariadb and mysql modules cannot be installed in parallel in RHEL 8.0 due to conflicting RPM packages.

Problems in mod_cgid logging

If the mod_cgid Apache httpd module is used under a threaded multi-processing module (MPM), which is the default situation in RHEL 8, the following logging problems occur:

The IO::Socket::SSL Perl module does not support TLS 1.3

New features of the TLS 1.3 protocol, such as session resumption or post-handshake authentication, were implemented in the RHEL 8 OpenSSL library but not in the Net::SSLeay Perl module, and thus are unavailable in the IO::Socket::SSL Perl module. Consequently, client certificate authentication might fail and reestablishing sessions might be slower than with the TLS 1.2 protocol.

Generated Scala documentation is unreadable

When generating documentation using the scaladoc command, the resulting HTML page is unusable due to missing JavaScript resources.

qxl does not work on VMs based on Wayland

The qxl driver is not able to provide kernel mode setting features on certain hypervisors. Consequently, the graphics based on the Wayland protocol are not available to virtual machines (VMs) that use qxl, and the Wayland-based login screen does not start.

The console prompt is not displayed when running systemctl isolate multi-user.target

When running the systemctl isolate multi-user.target command from GNOME Terminal in a GNOME Desktop session, only a cursor is displayed, and not the console prompt. To work around the problem, press the Ctrl+Alt+F2 keys. As a result, the console prompt appears.

Desktop running on X.Org hangs when changing to low screen resolutions

When using the GNOME desktop with the X.Org display server, the desktop becomes unresponsive if you attempt to change the screen resolution to low values. To work around the problem, do not set the screen resolution to a value lower than 800 × 600 pixels.

radeon fails to reset hardware correctly

The radeon kernel driver currently does not reset hardware in the kexec context correctly. Instead, radeon falls over, which causes the rest of the kdump service to fail.

Backup slave MII status does not work when using the ARP link monitor

By default, devices managed by the i40e driver, do source pruning, which drops packets that have the source Media Access Control (MAC) address that matches one of the receive filters. As a consequence, backup slave Media Independent Interface (MII) status does not work when using the Address Resolution Protocol (ARP) monitoring in channel bonding. To work around this problem, disable source pruning by the following command:

The HP NMI watchdog in some cases does not generate a crash dump

The hpwdt driver for the HP NMI watchdog is sometimes not able to claim a non-maskable interrupt (NMI) generated by the HPE watchdog timer because the NMI was instead consumed by the perfmon driver.

The KCM credential cache is not suitable for a large number of credentials in a single credential cache

The Kerberos Credential Manager (KCM) can handle ccache sizes of up to 64 kB. If it contains too many credentials, Kerberos operations, such as kinit, fail due to a hardcoded limit on the buffer used to transfer data between the sssd-kcm component and the underlying database.

Changing /etc/nsswitch.conf requires a manual system reboot

Any change to the /etc/nsswitch.conf file, for example running the authselect select profile_id command, requires a system reboot so that all relevant processes use the updated version of the /etc/nsswitch.conf file. If a system reboot is not possible, restart the service that joins your system to Active Directory, which is the System Security Services Daemon (SSSD) or winbind.

Conflicting timeout values prevent SSSD from connecting to servers

Some of the default timeout values related to the failover operations used by the System Security Services Daemon (SSSD) are conflicting. Consequently, the timeout value reserved for SSSD to talk to a single server prevents SSSD from trying other servers before the connecting operation as a whole time out. To work around the problem, set the value of the ldap_opt_timeout timeout parameter higher than the value of the dns_resolver_timeout parameter, and set the value of the dns_resolver_timeout parameter higher than the value of the dns_resolver_op_timeout parameter.

SSSD can look up only unique certificates in ID overrides

When multiple ID overrides contain the same certificate, the System Security Services Daemon (SSSD) is unable to resolve queries for the users that match the certificate. An attempt to look up these users does not return any user. Note that looking up users by using their user name or UID works as expected.

SSSD does not correctly handle multiple certificate matching rules with the same priority

If a given certificate matches multiple certificate matching rules with the same priority, the System Security Services Daemon (SSSD) uses only one of the rules. As a workaround, use a single certificate matching rule whose LDAP filter consists of the filters of the individual rules concatenated with the | (or) operator. For examples of certificate matching rules, see the sss-certamp(5) man page.

SSSD returns incorrect LDAP group membership for local users

If the System Security Services Daemon (SSSD) serves users from the local files, the files provider does not include group memberships from other domains. As a consequence, if a local user is a member of an LDAP group, the id local_user command does not return the user’s LDAP group membership. To work around the problem, either revert the order of the databases where the system is looking up the group membership of users in the /etc/nsswitch.conf file, replacing sss files with files sss, or disable the implicit files domain by adding

Sudo rules might not work with id_provider=ad if sudo rules reference group names

System Security Services Daemon (SSSD) does not resolve Active Directory group names during the initgroups operation because of an optimization of communication between AD and SSSD by using a cache. The cache entry contains only a Security Identifiers (SID) and not group names until the group is requested by name or ID. Therefore, sudo rules do not match the AD group unless the groups are fully resolved prior to running sudo.

Default PAM settings for systemd-user have changed in RHEL 8 which may influence SSSD behavior

The Pluggable authentication modules (PAM) stack has changed in Red Hat Enterprise Linux 8. For example, the systemd user session now starts a PAM conversation using the systemd-user PAM service. This service now recursively includes the system-auth PAM service, which may include the pam_sss.so interface. This means that the SSSD access control is always called.

IdM server does not work in FIPS

Due to an incomplete implementation of the SSL connector for Tomcat, an Identity Management (IdM) server with a certificate server installed does not work on machines with the FIPS mode enabled.

Samba denies access when using the sss ID mapping plug-in

To use Samba as a file server on a RHEL host joined to an Active Directory (AD) domain, the Samba Winbind service must be running even if SSSD is used to manage user and groups from AD. If you join the domain using the realm join --client-software=sssd command or without specifying the --client-software parameter in this command, realm creates only the /etc/sssd/sssd.conf file. When you run Samba on the domain member with this configuration and add a configuration that uses the sss ID mapping back end to the /etc/samba/smb.conf file to share directories, changes in the ID mapping back end can cause errors. Consequently, Samba denies access to files in certain cases, even if the user or group exists and it is known by SSSD.

The nuxwdog service fails in HSM environments and requires to install the keyutils package in non-HSM environments

The nuxwdog watchdog service has been integrated into Certificate System. As a consequence, nuxwdog is no longer provided as a separate package. To use the watchdog service, install the pki-server package.

Adding ID overrides of AD users works only in the IdM CLI

Currently, adding ID overrides of Active Directory (AD) users to Identity Management (IdM) groups for the purpose of granting access to management roles fails in the IdM Web UI. To work around the problem, use the IdM command-line interface (CLI) instead.

No information about required DNS records displayed when enabling support for AD trust in IdM

When enabling support for Active Directory (AD) trust in Red Hat Enterprise Linux Identity Management (IdM) installation with external DNS management, no information about required DNS records is displayed. Forest trust to AD is not successful until the required DNS records are added. To work around this problem, run the 'ipa dns-update-system-records --dry-run' command to obtain a list of all DNS records required by IdM. When external DNS for IdM domain defines the required DNS records, establishing forest trust to AD is possible.

Potential risk when using the default value for ldap_id_use_start_tls option

When using ldap:// without TLS for identity lookups, it can pose a risk for an attack vector. Particularly a man-in-the-middle (MITM) attack which could allow an attacker to impersonate a user by altering, for example, the UID or GID of an object returned in an LDAP search.

Synthetic functions generated by GCC confuse SystemTap

GCC optimization can generate synthetic functions for partially inlined copies of other functions. Tools such as SystemTap and GDB can not distinguish these synthetic functions from real functions. As a consequence, SystemTap can place probes on both synthetic and real function entry points, and thus register multiple probe hits for a single real function call.

The ltrace tool does not report function calls

Because of improvements to binary hardening applied to all RHEL components, the ltrace tool can no longer detect function calls in binary files coming from RHEL components. As a consequence, ltrace output is empty because it does not report any detected calls when used on such binary files. There is no workaround currently available.

Unable to discover an iSCSI target using the iscsiuio package

Red Hat Enterprise Linux 8 does not allow concurrent access to PCI register areas. As a consequence, a could not set host net params (err 29) error was set and the connection to the discovery portal failed. To work around this problem, set the kernel parameter iomem=relaxed in the kernel command line for the iSCSI offload. This specifically involves any offload using the bnx2i driver. As a result, connection to the discovery portal is now successful and iscsiuio package now works correctly.

VDO volumes lose deduplication advice after moving to a different-endian platform

Virtual Data Optimizer (VDO) writes the Universal Deduplication Service (UDS) index header in the endian format native to your platform. VDO considers the UDS index corrupt and overwrites it with a new, blank index if you move your VDO volume to a platform that uses a different endian.

The XFS DAX mount option is incompatible with shared copy-on-write data extents

An XFS file system formatted with the shared copy-on-write data extents feature is not compatible with the -o dax mount option. As a consequence, mounting such a file system with -o dax fails.

Certain SCSI drivers might sometimes use an excessive amount of memory

Certain SCSI drivers use a larger amount of memory than in RHEL 7. In certain cases, such as vPort creation on a Fibre Channel host bus adapter (HBA), the memory usage might be excessive, depending upon the system configuration.

nftables does not support multi-dimensional IP set types

The nftables packet-filtering framework does not support set types with concatenations and intervals. Consequently, you cannot use multi-dimensional IP set types, such as hash:net,port, with nftables.

The TRACE target in the iptables-extensions(8) man page does not refer to the nf_tables variant

The description of the TRACE target in the iptables-extensions(8) man page refers only to the compat variant, but Red Hat Enterprise Linux (RHEL) 8.0 uses the nf_tables variant. The nftables-based iptables utility in RHEL uses the meta nftrace expression internally. Therefore, the kernel does not print TRACE events in the kernel log but sends them to the user space instead. However, the man page does not reference the xtables-monitor command-line utility to display these events.

RHEL 8 shows the status of an 802.3ad bond as "Churned" after a switch was unavailable for an extended period of time

Currently, when you configure an 802.3ad network bond and the switch is down for an extended period of time, Red Hat Enterprise Linux properly shows the status of the bond as "Churned", even after the connection returns to a working state. However, this is the intended behavior, as the "Churned" status aims to tell the administrator that a significant link outage occurred. To clear this status, restart the network bond or reboot the host.

The ebtables command does not support broute table

The nftables-based ebtables command in Red Hat Enterprise Linux 8.0 does not support the broute table. Consequently, users can not use this feature.

IPsec network traffic fails during IPsec offloading when GRO is disabled

IPsec offloading is not expected to work when Generic Receive Offload (GRO) is disabled on the device. If IPsec offloading is configured on a network interface and GRO is disabled on that device, IPsec network traffic fails.

NetworkManager now uses the internal DHCP plug-in by default

NetworkManager supports the internal and dhclient DHCP plug-ins. By default, NetworkManager in Red Hat Enterprise Linux (RHEL) 7 uses the dhclient and RHEL 8 the internal plug-in. In certain situations, the plug-ins behave differently. For example, dhclient can use additional settings specified in the /etc/dhcp/ directory.

Advanced options of IPsec based VPN cannot be changed using gnome-control-center

When configuring an IPsec based VPN connection using the gnome-control-center application, the Advanced dialog will only display the configuration, but will not allow doing any change. As a consequence, users cannot change any advanced IPsec options. To work around this problem, use the nm-connection-editor or nmcli tools to perform configuration of the advanced properties.

The /etc/hosts.allow and /etc/hosts.deny files contain inaccurate information

The tcp_wrappers package is removed in Red Hat Enterprise Linux (RHEL) 8, but not its files, /etc/hosts.allow and /etc/hosts.deny. As a consequence, these files contain outdated information, which is not applicable for RHEL 8.

IP defragmentation cannot be sustainable under network traffic overload

In Red Hat Enterprise Linux 8, the garbage collection kernel thread has been removed and IP fragments expire only on timeout. As a result, CPU usage under Denial of Service (DoS) is much lower, and the maximum sustainable fragments drop rate is limited by the amount of memory configured for the IP reassembly unit. With the default settings workloads requiring fragmented traffic in presence of packet drops, packet reorder or many concurrent fragmented flows may incur in relevant performance regression.

Network interface name changes in RHEL 8

In Red Hat Enterprise Linux 8, the same consistent network device naming scheme is used by default as in RHEL 7. However, some kernel drivers, such as e1000e, nfp, qede, sfc, tg3 and bnxt_en changed their consistent name on a fresh installation of RHEL 8. However, the names are preserved on upgrade from RHEL 7.

libselinux-python is available only through its module

The libselinux-python package contains only Python 2 bindings for developing SELinux applications and it is used for backward compatibility. For this reason, libselinux-python is no longer available in the default RHEL 8 repositories through the dnf install libselinux-python command.

libssh does not comply with the system-wide crypto policy

The libssh library does not follow system-wide cryptographic policy settings. As a consequence, the set of supported algorithms is not changed when the administrator changes the crypto policies level using the update-crypto-policies command.

Certain rsyslog priority strings do not work correctly

Support for the GnuTLS priority string for imtcp that allows fine-grained control over encryption is not complete. Consequently, the following priority strings do not work properly in rsyslog:

Negative effects of the default logging setup on performance

The default logging environment setup might consume 4 GB of memory or even more and adjustments of rate-limit values are complex when systemd-journald is running with rsyslog.

OpenSCAP rpmverifypackage does not work correctly

The chdir and chroot system calls are called twice by the rpmverifypackage probe. Consequently, an error occurs when the probe is utilized during an OpenSCAP scan with custom Open Vulnerability and Assessment Language (OVAL) content.

SCAP Workbench fails to generate results-based remediations from tailored profiles

The following error occurs when trying to generate results-based remediation roles from a customized profile using the SCAP Workbench tool:

Kickstart uses org_fedora_oscap instead of com_redhat_oscap in RHEL 8

The Kickstart references the Open Security Content Automation Protocol (OSCAP) Anaconda add-on as org_fedora_oscap instead of com_redhat_oscap which might cause confusion. That is done to preserve backward compatibility with Red Hat Enterprise Linux 7.

OpenSCAP rpmverifyfile does not work

The OpenSCAP scanner does not correctly change the current working directory in offline mode, and the fchdir function is not called with the correct arguments in the OpenSCAP rpmverifyfile probe. Consequently, scanning arbitrary file systems using the oscap-chroot command fails if rpmverifyfile_test is used in an SCAP content. As a result, oscap-chroot aborts in the described scenario.

OpenSCAP does not provide offline scanning of virtual machines and containers

Refactoring of OpenSCAP codebase caused certain RPM probes to fail to scan VM and containers file systems in offline mode. For that reason, the following tools were removed from the openscap-utils package: oscap-vm and oscap-chroot. Also, the openscap-containers package was completely removed.

A utility for security and compliance scanning of containers is not available

In Red Hat Enterprise Linux 7, the oscap-docker utility can be used for scanning of Docker containers based on Atomic technologies. In Red Hat Enterprise Linux 8, the Docker- and Atomic-related OpenSCAP commands are not available. As a result, oscap-docker or an equivalent utility for security and compliance scanning of containers is not available in RHEL 8 at the moment.

The OpenSSL TLS library does not detect if the PKCS#11 token supports creation of raw RSA or RSA-PSS signatures

The TLS-1.3 protocol requires the support for RSA-PSS signature. If the PKCS#11 token does not support raw RSA or RSA-PSS signatures, the server applications which use OpenSSL TLS library will fail to work with the RSA key if it is held by the PKCS#11 token. As a result, TLS communication will fail.

Apache httpd fails to start if it uses an RSA private key stored in a PKCS#11 device and an RSA-PSS certificate

The PKCS#11 standard does not differentiate between RSA and RSA-PSS key objects and uses the CKK_RSA type for both. However, OpenSSL uses different types for RSA and RSA-PSS keys. As a consequence, the openssl-pkcs11 engine cannot determine which type should be provided to OpenSSL for PKCS#11 RSA key objects. Currently, the engine sets the key type as RSA keys for all PKCS#11 CKK_RSA objects. When OpenSSL compares the types of an RSA-PSS public key obtained from the certificate with the type contained in an RSA private key object provided by the engine, it concludes that the types are different. Therefore, the certificate and the private key do not match. The check performed in the X509_check_private_key() OpenSSL function returns an error in this scenario. The httpd web server calls this function in its startup process to check if the provided certificate and key match. Since this check always fails for a certificate containing an RSA-PSS public key and a RSA private key stored in the PKCS#11 module, httpd fails to start using this configuration. There is no workaround available for this issue.

httpd fails to start if it uses an ECDSA private key without corresponding public key stored in a PKCS#11 device

Unlike RSA keys, ECDSA private keys do not necessarily contain public key information. In this case, you cannot obtain the public key from an ECDSA private key. For this reason, a PKCS#11 device stores public key information in a separate object whether it is a public key object or a certificate object. OpenSSL expects the EVP_PKEY structure provided by an engine for a private key to contain the public key information. When filling the EVP_PKEY structure to be provided to OpenSSL, the engine in the openssl-pkcs11 package tries to fetch the public key information only from matching public key objects and ignores the present certificate objects.

OpenSSH does not handle PKCS #11 URIs for keys with mismatching labels correctly

The OpenSSH suite can identify key pairs by a label. The label might differ on private and public keys stored on a smart card. Consequently, specifying PKCS #11 URIs with the object part (key label) can prevent OpenSSH from finding appropriate objects in PKCS #11.

Output of iptables-ebtables is not 100% compatible with ebtables

In RHEL 8, the ebtables command is provided by the iptables-ebtables package, which contains an nftables-based reimplementation of the tool. This tool has a different code base, and its output deviates in aspects, which are either negligible or deliberate design choices.

curve25519-sha256 is not supported by default in OpenSSH

The curve25519-sha256 SSH key exchange algorithm is missing in the system-wide crypto policies configurations for the OpenSSH client and server even though it is compliant with the default policy level. As a consequence, if a client or a server uses curve25519-sha256 and this algorithm is not supported by the host, the connection might fail.

OpenSSL incorrectly handles PKCS #11 tokens that does not support raw RSA or RSA-PSS signatures

The OpenSSL library does not detect key-related capabilities of PKCS #11 tokens. Consequently, establishing a TLS connection fails when a signature is created with a token that does not support raw RSA or RSA-PSS signatures.

SSH connections with VMware-hosted systems do not work

The current version of the OpenSSH suite introduces a change of the default IP Quality of Service (IPQoS) flags in SSH packets, which is not correctly handled by the VMware virtualization platform. Consequently, it is not possible to establish an SSH connection with systems on VMware.

No message is printed for the successful setting and unsetting of service-level

When the candlepin service does not have a 'syspurpose' functionality, subscription manager uses a different code path to set the service-level argument. This code path does not print the result of the operation. As a consequence, no message is displayed when the service level is set by subscription manager. This is especially problematic when the service-level set has a typo or is not truly available.

syspurpose addons have no effect on the subscription-manager attach --auto output.

In Red Hat Enterprise Linux 8, four attributes of the syspurpose command-line tool have been added: role,usage, service_level_agreement and addons. Currently, only role, usage and service_level_agreement affect the output of running the subscription-manager attach --auto command. Users who attempt to set values to the addons argument will not observe any effect on the subscriptions that are auto-attached.

ESXi virtual machines that were customized using cloud-init and cloned boot very slowly

Currently, if the cloud-init service is used to modify a virtual machine (VM) that runs on the VMware ESXi hypervisor to use static IP and the VM is then cloned, the new cloned VM in some cases takes a very long time to reboot. This is caused cloud-init rewriting the VM’s static IP to DHCP and then searching for an available datasource.

Enabling nested virtualization blocks live migration

Currently, the nested virtualization feature is incompatible with live migration. Therefore, enabling nested virtualization on a RHEL 8 host prevents migrating any virtual machines (VMs) from the host, as well as saving VM state snapshots to disk.

Using cloud-init to provision virtual machines on Microsoft Azure fails

Currently, it is not possible to use the cloud-init utility to provision a RHEL 8 virtual machine (VM) on the Microsoft Azure platform. To work around this problem, use one of the following methods:

Generation 2 RHEL 8 virtual machines sometimes fail to boot on Hyper-V Server 2016 hosts

When using RHEL 8 as the guest operating system on a virtual machine (VM) running on a Microsoft Hyper-V Server 2016 host, the VM in some cases fails to boot and returns to the GRUB boot menu. In addition, the following error is logged in the Hyper-V event log:

virsh iface-\* commands do not work consistently

Currently, virsh iface-* commands, such as virsh iface-start and virsh iface-destroy, frequently fail due to configuration dependencies. Therefore, it is recommended not to use virsh iface-\* commands for configuring and managing host network connections. Instead, use the NetworkManager program and its related management applications.

Linux virtual machine extensions for Azure sometimes do not work

RHEL 8 does not include the python2 package by default. As a consequence, running Linux virtual machine extensions for Azure, also known as azure-linux-extensions, on a RHEL 8 VM in some cases fails.

redhat-support-tool does not collect sosreport automatically from opencase

The redhat-support-tool command cannot create a sosreport archive. To work around this problem, run the sosreport command separately and then enter the redhat-support-tool addattachment -c command to upload the archive or use web UI on the Customer Portal. As a result, a case will be created and sosreport will be uploaded.